Staying Cyber Safe: Practical Cyber Security Tips for Law Firms

• Cybersecurity is a distinct and relevant aspect that applies to everyone, not just large companies. It is a unique challenge that affects individuals and organisations alike.
• While firms often focus on securing document and email management systems, remote access, and mobile services under cybersecurity, they overlook the vulnerabilities in e-discovery systems.
• Litigation support services and e-discovery are critical areas where confidential client information, evidence for cases, and important data are stored, making them prime targets for cyber criminals.
• Small to medium firms are often targeted by cyber criminals because they are more likely to pay ransom demands to retrieve their data, even though these payments can be financially damaging.
• However, regardless of size, all firms are potential targets for cyber attacks and larger firms are not immune to being targeted.
• Cybersecurity challenges can affect all teams, including IT teams, as they require specialised knowledge and skills.
• ISO 27001 is a risk-based standard focused on information security, requiring a risk assessment to identify and mitigate risks to data confidentiality, integrity, and availability.
• Compliance with this standard results in certification of having an information security management system in place, with other standards such as SOC and ISO 27017 also available for specific security needs, including privacy and cloud-based standards.
• Having an ISO certification indicates that a vendor has security measures in place, which can provide a level of confidence in selecting them.
• Further, in Australia, the Essential Eight cybersecurity framework emphasises measures such as multifactor authentication, patching, updates to operational systems, application control, and access control.
• It also includes having an incident response plan, which many firms overlook or mistakenly assume is covered by cyber liability insurance.

• Firms need to take responsibility for assessing the cybersecurity risks associated with their vendors, as cyber liability insurance may not fully protect them if data breaches occur on either the vendor or firm’s side.
• As such, it is important for firms to verify what happens to their data when they stop using a vendor, ensuring that the vendor has a deletion policy in place and properly manages the data.
• To avoid falling victim to phishing attacks, it is crucial for individuals to be vigilant and take extra steps to verify the authenticity of emails or requests, especially when they appear urgent or come from high-ranking individuals.
• Having an ISO certification is a good starting point for data security, but it does not guarantee protection from breaches.
• It is important to continually question the ways data security is being handled, as even companies like Microsoft, with ISO certification, have experienced breaches.
• When choosing cyber insurance, consider if it includes third party coverage for incidents involving vendors or clients. Look for coverage for your firm in case of a data breach and ensure it offers incident response coverage.
• Including these three elements in your policy can provide protection for your firm against costly data forensic services and additional security against third party attacks.
• Cybersecurity awareness training is typically done annually, but there is a growing need for threat intelligence, which involves staying updated on new threats through vendor updates, attending conferences, and utilising free online resources.
• Consider enhancing training by providing monthly updates on emerging threats to keep cybersecurity at the forefront of your firm’s focus.

The Australian Signals Directorate (ASD), Essential Eight

In today’s episode of Hearsay, we’re going to be exploring the intersection of legal practice and technology with a focus on cybersecurity, eDiscovery and workflow optimization, and we’re going to talk about how all these topics interact with one another as well. Law firms (both large and small) are increasingly reliant on technology to manage sensitive client information, which makes them prime targets for cybercriminals as other traditionally attractive targets like banks harden their security posture. Effective strategies to secure data, streamline processes and maintain compliance are no longer optional; they’re essential to building trust and protecting a firm’s reputation.

Our guest today is Santana Stallberg, founder of Legal Tech Consulting Inc. Santana is an entrepreneur, ISO Lead Auditor and eDiscovery Specialist. Through Legal Tech Consulting Inc., she provides solutions to help law firms and legal businesses with services ranging from eDiscovery, information security consultations, workflow optimization and litigation support and legal document preparation and business development.

Santana has hands-on legal-tech expertise and supports firms of all sizes in adapting to the fast-changing legal and cybersecurity landscape.

Santana, welcome to Hearsay.

TIP: Santana has just mentioned that small to medium firms actually tend to be targeted more often, and this is supported in the data around cyber attacks in Australia.

A 2024 Australian report called ‘Under the Hood’, published by Clyde & Co, looked at 100 real cyber incidents that happened over about a 15-month period. And what really stood out was where those incidents landed. Using the ATO’s definitions of small and medium businesses, the report found that around 93% of business email compromise incidents, and about 96% of ransomware incidents, affected small to medium organisations.

So, overwhelmingly, this isn’t a “big firm only” problem.

Professional services,  including law firms, were among the most affected sectors, particularly when it came to business email compromise. That’s likely because of the sensitive data that fills our inboxes: personal client information, financial details, settlement timelines, and instructions that often need to move quickly. From a cyber criminal’s perspective, these inboxes can be real gold mines. 

The report also challenges the idea that attackers are always carefully choosing their targets. While large organisations do attract attention, many threat actors are opportunistic. They scan for weaknesses and see what they can get access to. Smaller firms often have fewer resources, less time to spend on cyber security, and lower overall cyber maturity, which can make them easier entry points.

And then there’s the uncomfortable reality around ransom payments. The report notes that smaller organisations are more likely to pay, often because they just want their data back and need to keep operating. But for a small or mid-sized firm, even a single ransomware payment can be enough to cause serious financial strain.

All of this sits in a broader Australian context. As Clyde & Co notes in the report, we are a country of small businesses; more than 90% of Australian businesses turn over less than $2 million a year. The report describes this as a genuine “small business problem” for cyber security, driven less by apathy and more by limited time, resources, and access to support.

We always say in the cybersecurity world, “it’s a matter of when, and not if.” You’re honestly always a potential target, no matter the size of the firm. Just because you’re a larger firm doesn’t mean that you’re going to get attacked less or more. Essentially, the reality of it is smaller firms, because cyber criminals know that they don’t have anything in place, makes them easy targets, actually.

TIP: You might have just heard Santana mention the Essential Eight. That’s an Australian cyber security framework, developed by the Australian Signals Directorate through the Australian Cyber Security Centre, and it’s probably one of the most practical benchmarks we have in this space.

At its core, the Essential Eight is eight basic cyber security strategies that the ACSC says are the most effective at stopping common, high-volume attacks: things like ransomware, phishing, and credential theft. It’s carved out of a much larger list of controls, but these eight are considered the minimum baseline that really moves the needle.

Importantly, the Essential Eight focuses on practical, technical controls; including patching applications and operating systems, using multi-factor authentication, restricting admin privileges, locking down Microsoft Office macros, and making sure backups are done properly and can actually be restored.

The ACSC also publishes what’s called the Essential Eight Maturity Model. That runs from Level 0 to Level 3, with each level reflecting how consistently and rigorously those controls are implemented. For example, higher maturity levels mean tighter patching timeframes and stronger enforcement of access controls. For many Australian government agencies, reaching at least Maturity Level 2 is mandatory.

For private organisations, including law firms, the Essential Eight generally isn’t legally required. But in practice, it’s become the de facto benchmark for what “reasonable” cyber security looks like in Australia. It’s commonly used in government procurement, panel tenders, cyber insurance discussions, and board-level risk reporting.

For smaller firms, the Essential Eight can actually be a helpful place to start. It gives you a clear checklist, helps prioritise effort, and lets you work out where you are now, and what the shortest path is to a defensible, Australian-recognised baseline.

TIP: You might have just heard Santana mention ISO, NIST and SOC, and if those sound like a bit of alphabet soup, you’re not alone. 

At a high level, all three are ways organisations show that they take information security seriously and manage cyber risk against recognised standards.

Let’s start with ISO. When people talk about ISO in a cyber context, they usually mean ISO 27001. This is an international standard focused on having a proper Information Security Management System, or ISMS. In plain terms, that means documented policies, risk assessments, security controls, and a process for continually improving how information is protected. ISO 27001 is certifiable, which means an independent auditor can assess an organisation and, if it meets the requirements, certify it. That certification isn’t forever. It’s reviewed regularly and fully re-certified every few years.

NIST is a bit different. NIST refers to cyber security frameworks published by the U.S. National Institute of Standards and Technology. These are detailed guides and control libraries that help organisations think through cyber risk and security controls. There isn’t a global “NIST certification” available. Instead, organisations will usually describe themselves as being aligned with or compliant with NIST frameworks.

SOC is different again. SOC reports are independent audit reports, most commonly SOC 2, that assess how a specific service environment is controlled. A SOC 2 report looks at areas like security, availability and confidentiality and produces a detailed report that clients can review. You’ll often hear people talk about SOC 2 Type I or Type II, which simply reflect whether the controls were assessed at a point in time or over a longer period.

In practice, many organisations use all three together: NIST to design their controls, ISO 27001 to manage them day-to-day, and SOC reports to show clients how those controls actually operate.

And it strikes me that ISO accreditation is, paradoxically, it can be like too much and not enough. So, as we’ve just said, when you’re looking at selecting a vendor, it might not be the answer to every question you have about their security posture or where their data’s stored or what their privacy practices are. At the same time, there might be a perspective among law firms that like, “well, that’s for tech companies. Like, why would I get 27001 accreditation? I can’t get that. It’s gonna be too onerous. It’s gonna be really hard for me to get, and then hard for me to maintain. There’s so many controls that I need to deal with. I’ll have to completely change the way I operate.” But it’s actually a proportionate assessment, isn’t it?

TIP: Santana has just mentioned the Qantas cyber attack, pointing to a really good example of how cyber incidents can have consequences well beyond IT systems.

In mid-2025, Qantas confirmed a major cyber attack that potentially exposed the personal details of around six million customers. Attackers gained access to a third-party customer service platform used by an offshore call centre. Reports suggest social-engineering tactics were involved, essentially tricking staff or systems into granting access.

The data exposed included things like names, email addresses, phone numbers, dates of birth and frequent flyer numbers. Qantas has said that more sensitive data, like credit card details, passwords, PINs and passport numbers, was not part of the compromised dataset. Even so, the scale of the incident meant millions of customers were affected, and the reputational and regulatory fallout was significant.

That incident is often compared to the Optus breach in 2022, which remains one of Australia’s largest data breaches. In that case, attackers accessed Optus customer data through an internet-facing API that didn’t require authentication.

About 9.8 to 10 million current and former Optus customers were affected, roughly one-third of Australia’s population. For millions of people, personal details like names, dates of birth, phone numbers and addresses were exposed. For around two million, government ID numbers such as driver licences and passports were also compromised.

Optus initially described the breach as sophisticated, but later investigations characterised it as a preventable security failure. Since then, there have been regulatory investigations, court proceedings, and multiple class actions.

Together, these incidents show that cyber attacks can trigger regulatory scrutiny, litigation, reputational damage and long-term trust issues, even for some of Australia’s biggest and most resourced organisations.

You can’t go back in time, unfortunately, but if you start to proactively manage the potential risks, you’re putting yourself in a better position, and that’s really what you can do. And so hopefully you don’t get breached, but the reality of it is, is at some point, even a small breach will impact a firm. And so if you have the right security controls in place and you’re actively working with clients to meet the requirements as well, it’s also putting that boundary. Some clients will say, “yeah, let’s use Google Drive or Dropbox.“ If you set up that you’re going to use a secure file transfer system, maintain those boundaries and those security requirements as well, and explain to a client, “this is why I’m doing this, because it protects both of us.” So being honest with your clients as well as starting to implement or even having a plan to implement controls. After a breach, I mean, it’s putting a bandaid on it. I’d say proactively do it rather than reactively do it. But making sure that you’re constantly thinking about cybersecurity is one of the ways you can definitely prepare that relationship.

So Santana, thank you so much for joining me today on Tuesday.

If you’re an Australian legal practitioner, you can claim one continuing professional development point for listening to this episode. Now, as you know, whether an activity entitles you to claim a CPD unit is self-assessed but we suggest that this episode entitles you to claim one practice management and business skills point or a professional skills point – take your pick. For more information on claiming and tracking your points, head on over to the Hearsay website.

Hearsay the Legal Podcast is brought to you by Lext Australia, a legal innovation company that makes the law easier to access and easier to practice and that includes your CPD.

Now, before you go, we’d like to ask you a favour, listeners. If you’re enjoying Hearsay the Legal Podcast, please consider leaving us a Google review. It helps other listeners to find us and ultimately it keeps us in business.

Thanks for listening and we’ll see you on the next episode of Hearsay.