Let's try to unpack this. Almost 9 out of 10 survey respondents claim their firm utilizes secure sharing tools. With high profile data breaches, General Data Protection Regulation (GDPR) concerns, HIPAA, and business associate agreements, in addition to similar regulatory requirements, firms are responding to the need for more secure communications. Additionally, there's an expectation of trust and confidentiality between an attorney and his or her client. But, while a majority of firms have implemented solutions to try and secure their communication channels, more than half of their employees are still unaware of the risks of email, and ultimately, resort to whatever is easiest — no matter the security risks. The survey also found that employees were using Google Drive, personal Dropbox accounts, and other “shadow IT” applications to share information both internally and externally.

Some of the reasons behind employees' non-compliance? Thirty-seven and a half percent of employees expressed not using secure data transfer/sharing tools because of a lack of consequences when it came to following their firms' security policies. This was true throughout organizations, regardless of their role or seniority. Additionally, two out of three junior and mid-level employees simply believe that compliance “doesn't matter” when it comes to risky behavior. Noncompliance was also found among senior employees — with half of senior management and partners admitting they don't believe compliance lessened a firm's security risks. In addition, the survey found that employees aren't motivated to follow security policies, with more than half reporting that a lack of reward for following their firms' security policies reduces their motivation to comply.

How Legal Firms Can Improve Data Security

It's a good sign that so many firms have made the investment to use secure sharing tools. However, it's not enough to simply put the tools in place. It's up to the firm to ensure every employee knows about the secure tools available and how and when to use them. As new employees are on-boarded, their initiation should prioritize training around information security policies and how to use the provided tools. Beyond on-boarding, training and education should be performed on a regular basis to keep things top of mind.

For those firms that have provided secure solutions yet seem to have low adoption, it's important to understand the root cause. An internal questionnaire can help gauge employees' understanding of cybersecurity best practices.

One of the biggest reasons for low adoption rates when using secure sharing and communication tools in law firms has been complexity. Biscom's data revealed that, on average, it takes employees eight additional minutes per transaction to perform a task when using a secure tool compared with their “normal” method, which is most likely email. Not including the time to write an email, it usually takes only a few seconds to address and send an email. Eight additional minutes to use a more secure method is quite a bit of time that people would rather use performing their primary job function.

Biscom found that ease-of-use is paramount in increasing those adoption numbers. In addition, minimizing changes to existing behaviors, creating a good user experience, and providing additional capabilities that are otherwise unavailable also increase adoption. Understanding this data, firms can better implement tools that meet the needs of their employees, while knowing sensitive data remains secure. For example, implementing a secure messaging tool that easily integrates with employees' existing email platforms is simple to use and complies with policy rules for automating the delivery — all while providing tracking and auditing — will help meet all of these needs of employees and employers, while also only marginally adding to a worker's time.

On the other hand, complexity is an issue that goes both ways. Firms work with a diverse group of clients, and as some may not be technically savvy, ensuring an intuitive client experience is also important. Being able to receive communications that are not only secure, but also easy to access, can make all the difference in customer satisfaction.

Conclusion

With stricter regulations such as GDPR, as well as the costly impact of the loss of a firm's intellectual property, and breaches of confidentiality, it is now more vital than ever to make sure your firm clearly understands threats and how to address them in the form of policies, processes and tools. While vetting a solution, security is often the most important requirement, but ensuring the solution also has a great user experience can help with better adoption and compliance. Once you've selected your secure sharing solutions, providing regular employee training, oversight, and accountability can ensure you're achieving the level of threat protection you've invested in.

*****

Bill Ho is CEO of Biscom, a secure document and messaging solutions company that enables firms to share and store documents securely. Over his 20 year career, Bill has worked closely with various companies in the legal, healthcare, financial services, and government spaces. Recognized as a security expert, Bill speaks frequently, including recent engagements at Secure World and Harvard Business School.