Seven tips to improve your cybersecurity

By Jeffrey Schoenberger, senior consultant at Affinity Consulting Group LLC

It's common to see news about cybersecurity spiral away from the helpful and actionable toward the sensational and convoluted. In the spirit of simple, direct, actionable solutions, here are seven suggestions to improve your cybersecurity situation.

Enable whole disk encryption

With in-person events picking up following the COVID-19 pandemic, our laptops are on-the-go and more people are visiting the office. Enable whole disk encryption on all laptops and desktops. If a thief steals your computer, they cannot access client information absent your username and password, even if they remove the physical hard drive from the stolen computer and install it in a different machine. Whole disk encryption is built in to Windows and macOS.

Enable “Find My”

Check whether your device’s remote location feature is enabled. Apple calls its service Find My, and Google’s is Find My Device. Microsoft's feature is also called Find My Device. With these services, you can locate the lost device, lock it, have it play a sound to help you find it, and, if necessary, remotely delete the device’s contents.

Apple’s service covers Macs, iOS devices, and some AirPods. Google’s service supports Android smartphones, tablets, and Chromebooks. Windows 10 and 11 users can enable Microsoft’s Find My Device.

Asset recovery tags

Larger organizations have long used numbered or barcoded stickers to track what equipment they have and where it is. Companies like Dynotag and ReturnMe take this inventory concept and make it accessible to individuals and small businesses.

You purchase an identity tag from the vendor, which could be a sticker (most common), keyring, luggage tag, or even a literal dog (or cat) tag. You then create an account and register the tag’s number to your account. If you misplace your tagged item, whoever finds the item calls an 800 number or visits a website (both listed on the tag) to arrange the item’s return.

Think of these tags as “Good Samaritan stickers.” They don’t prevent theft, but they make it easy for good people to be helpful.

Complex passwords

Unique, complex passwords remain essential for online security. Start with the LPM whitepaper on password managers for good information, but with one update: Replace LastPass with Bitwarden following the LastPass data breach in 2022. I have also used 1Password for years and am confident in recommending it.

If online password storage unnerves you, the open-source KeePass stores password data only locally on your machine, not in anyone’s cloud, but that makes you responsible for backing up and securing your data.

Finally, I recently learned one reason Rolodex still exists. A lawyer I met uses Rolodex cards for each of his passwords. For example, filed under “A” is a card for Amazon listing his email address and password. Considering the weaknesses of a single-copy paper record in one location, it’s imperfect but beats using the same password for many sites. If you prefer something more portable than a Rolodex, Amazon sells password notebooks.

Two-factor authentication

This LPM whitepaper provides a primer on two-factor authentication (2FA). Enable it on every web service you use that offers 2FA. Visit the 2FA Directory to discover whether your practice management software, bank, etc. makes 2FA available.

1Password, Dashlane, and Roboform support storing 2FA codes in their password managers. If you’re using another program, or a Rolodex or notebook, you’ll need an app like Google Authenticator, Microsoft Authenticator, or Twilio’s Authy.

Admin consoles

A practice larger than a solo lawyer, even just a single lawyer and one part-time support staffer, should buy or subscribe to the “business version” of most needed software or services. Business-tier plans typically include an administration dashboard to control device and user access.

Examine your vendors of subscription-based tools for document storage, productivity software, eSignatures, and more. Secure, centralized user access and content management are a lifesaver for a lost device, ease employee onboarding and departure, and add a “belt and suspenders” approach to client data when paired with whole disk encryption and a “find my” service.

VPN

If you’re working away from home or the office and need internet connectivity, don’t join whatever WiFi network is available, even if it’s “secured,” meaning anyone can ask the barista for the password. There are two sound ways to connect to the internet when away from your “known safe” networks.

First, use your smartphone as a WiFi hotspot. This will drain your phone’s battery and eat data, but it’s safe. Second, subscribe to and use virtual private network (VPN) software.

A VPN encrypts your internet traffic before it leaves your computer. Once the encrypted traffic arrives at the VPN vendor’s server, it’s decrypted and released onto the public internet. This approach prevents your coffeehouse or hotel lobby neighbors from eavesdropping. A VPN generally slows your internet connection, but it’s a tradeoff in favor of security. Visit the LPM comparison chart page to compare VPN providers.

Tackling these seven suggestions on a one-a-day schedule will dramatically boost your security in a week.

For more resources on opening, building, managing, protecting, and winding down a law practice, visit The Missouri Bar’s Law Practice Management Resource Center.