Cybersecurity Basics for Professional Services
The breaches that hit law firms, advisory practices and agencies are rarely sophisticated. They are a stolen password reused from another site, an invoice that looked real, a former employee whose account nobody closed. The defences are correspondingly unglamorous — and correspondingly effective.
Multi-factor authentication on everything that faces the internet
Email, remote access, cloud file storage, the accounting system. A password alone is no longer a control; it is a suggestion. Multi-factor authentication on mail and remote access closes the majority of real-world intrusions at firms this size, and it costs nothing but a few minutes per user. If a provider or vendor tells you it cannot be turned on, that is a reason to change the provider, not the policy.
Separate the administrator from the person
Whoever administers your systems should do it from an account they do not read email with. A phishing message that lands in an ordinary inbox should not be able to reach an account that can create users, change passwords or delete backups. This is a ten-minute change and it removes an entire class of failure.
Publish SPF, DKIM and DMARC
These three DNS records tell the rest of the world which servers are allowed to send mail in your name. Without them, anyone can send an invoice from your domain to your clients, and their mail systems will accept it. With them, forged mail is rejected before a human ever sees it. This is the single most effective protection for a firm whose clients pay invoices by email, and most firms have never checked whether it is in place.
Prove the backup works
A backup that has never been restored is a hope, not a control. Keep at least one copy offsite and outside the reach of a compromised account — a backup the attacker can also delete is not a backup. Then restore something from it, time how long it takes, and write the number down. That number is your real recovery time, and it is usually longer than anyone assumed.
Review who still has access
Most firms discover, on their first review, that former staff and old vendors still have working credentials. Departures are handled by HR; access removal is handled by nobody. Put the two together: every offboarding should end with an access review, and every quarter should include one regardless.
Where to start
- Turn on multi-factor authentication for mail and remote access this week
- Give administrators a separate account for administration
- Check your domain for SPF, DKIM and DMARC — a free lookup takes seconds
- Restore one file from backup and time it
- List every account that can log in, and remove the ones that should not
None of this requires new products. If you would like someone to check where you stand, a confidential review takes about an hour, and you keep the findings either way. Our cybersecurity work starts from exactly this list.