How Endpoint Protector Helps Law Firms

Law firms regularly collect and use highly sensitive data as part of the services they offer individuals and companies. Because they are not part of a highly regulated sector like health or finance, they are known to invest less in cybersecurity and have therefore become an increasingly attractive target for cybercriminals.

The American Bar Association’s 2019 Legal Technology Survey Report showed that 26% of the law firms participating in the survey had experienced a security breach in the last year. These incidents included cyberattacks, malware infection, but also lost or stolen company devices. The consequences were financial losses stemming from repair costs, loss of billable hours, or the need to replace hardware, but also the destruction or loss of files and the need to notify the authorities and clients of a data breach.

The legal liabilities of data breaches are also increasing: a new wave of data protection regulations such as the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) apply not only to specialized fields but to most organizations collecting and processing sensitive information. Companies that fail to protect their clients’ and employees’ personal data face steep fines and reputational damage.

Data breaches happen not only because of malicious outsiders but also because of employee negligence. This is particularly problematic for law firms because many of their employees handle sensitive data on a daily basis when they review cases and provide legal advice.

How Endpoint Protector helps law firms to secure data?

Data Loss Prevention (DLP) tools like Endpoint Protector can help law firms mitigate the risk of data breaches by helping them monitor and control how sensitive data is stored and used by employees. A number of Endpoint Protector features are particularly relevant for law firms. Let’s see which they are!

1. Defining sensitive data for law firms

While personally identifiable information (PII) such as IDs, social security numbers, or birth dates are the type of data classified as sensitive under most data protection regulations, law firms, depending on their field of expertise, can also work with additional sensitive data such as patents or intellectual property rights.

Endpoint Protector comes with predefined protection policies for the most common PIIs, but also offers companies the possibility to define their own custom categories of protected data, based on their needs. Companies can then easily scan over a hundred file types for the sensitive data they want to protect and ensure that its transfer is monitored and controlled.

2. Limiting the use of removable devices

One of the biggest problems faced by law firms is the number of devices employees connect to company computers and the ease with which data is transferred on and off them. Their prolific use means that law firms should hesitate to ban their use altogether as they are clearly needed by employees to perform their duties.

Endpoint Protector, through its USB Device Control module, offers law firms the possibility to control the use of removable devices by blocking or limiting the use of USB and peripheral ports. It gives them the option to block the connection of specific devices to company computers such as mobile phones, USBs, or external drives and allow access only to predefined trusted devices.

3. Granular policies for device control

Device control policies can be counterproductive when applied uniformly to all employees. This is why the Endpoint Protector has a high level of flexibility in the application of its policies. It means that different device control policies can be applied to specific users and computers or different groups or departments. Whitelists also allow admins to lift restrictions for particular individuals or devices.

4. Prepared for emergencies with Offline Temporary Passwords

Not only is flexibility needed when setting up DLP policies, but also when dealing with exceptional cases. When employees face a unique problem they must resolve quickly, rigid DLP policies can greatly frustrate or, worse, prevent them from dealing with it swiftly and efficiently.

Endpoint Protector has already taken such potential emergencies under consideration and admins can generate Offline Temporary Passwords that grant access rights for a limited time. These passwords can lift all restrictions for specific devices, users, or computers and can be used even remotely or when a computer is not connected to a network.

5. Keeping an eye on data with File Tracing

Another useful Endpoint Protector feature for law firms is the possibility to monitor sensitive data through its File Tracing and File Shadowing features. File Tracing allows companies to track files containing sensitive data and where they are being transferred, whether on removable devices such as USBs or via the internet.

File Shadowing is an extension of File Tracing that automatically saves a copy of all files that were flagged as violating security policies on the server for additional review. By logging sensitive data’s every step, law firms can discover potentially hazardous employee practices and where they need to strengthen their security policies.