Security Step 5: Secure Your Sensitive Data
The security and integrity of your data is of paramount importance, as practices typically have large amounts of confidential and sensitive information about clients. Not only do you have an ethical responsibility to protect this information, but often times, a legal responsibility as well.
So, what are some things you can do to meet these obligations?
Data in Motion
When handling sensitive information within a web browser, always make sure the web address starts with “https,” which indicates a secured connection. Data transmitted over a properly secured connection is encrypted and prevents an attacker from tampering with or accessing the information sent. Most browsers will highlight the address bar in green or show a closed lock to indicate that the connection is secure.
Beware of websites that may have misconfigured or outdated security. Avoid using any website that the browser flags as having an untrusted certificate, as the site or the connection may be compromised. For example, the browser might display a message stating “The site’s security certificate is not trusted” or “There is a problem with this website’s security certificate.”
Data at Rest
Data stored on your computer or a network storage device also need to be secured. Most modern operating systems support “whole drive” or “whole disk” encryption. Once enabled, you can be comfortable knowing that if your computer is ever lost or stolen, the data stored on it cannot be accessed by anyone else. To get started using whole drive encryption, search for “BitLocker” from the Start Menu on Windows Professional, or FileVault on Mac OS X.
For data that is backed up off of your computer, or that needs to be transmitted to other parties, file encryption is a must. Applications such as SecureZIP and OpenPGP implementations like Gpg4win (Windows) can secure your own data for storage, as well as ensure protected communication to third parties.
Data in the Cloud
Confidential information stored in cloud services, whether for archival or operating purposes, must usually meet requirements imposed by industry governing bodies. PCI in the payments space, and HIPAA for healthcare data, mandate minimum encryption standards for data that is processed or stored. These standards often require ongoing audits by external parties to ensure continuing compliance. When in doubt about the ways a service provider protects your confidential information, always ask for their security practices and certifications.
Parting Thoughts
Over our past five security tips, we have examined several steps you can take to secure the cyber assets in your office. From your network to your passwords, systems, and data, your firm should now be on a stronger security footing. Unfortunately, security is not a one-time event. Technology changes and new threats continue to emerge, but the practices discussed in this series continue to apply. As your office changes over time, keep your asset inventory up-to-date, and use the steps of this series as a simple checklist for maintaining the security of your practice.
LawPay is proud to be trusted by more than 45,000 law firms, recommended by 47 state bars, and the only payment solution offered through the ABA Advantage program. LawPay was developed specifically to separate earned and unearned payments, giving attorneys peace of mind that their credit card transactions are always handled correctly. To learn more, call 888-403-4876 or visit our website.
This content is advertising.
