The most common threat to data in small law firms is the failure to regularly make and have someone check that the data on the backup can be restored.

Twenty years ago, when computers were less reliable the need to make backups was high priority. Today, with hardware being so reliable, we don’t have a stream of constant disasters to remind us to backup. However, when disaster strikes, the consequences are far more damaging.

The old in-house client-server software solutions bring with them a whole raft of technologies that you need to understand to keep your data safe. You are a solicitor and should be time recording, not being concerned about backups.

The sad truth is that you may not always have honest and reliable staff, but fortunately it is a tiny percentage. Most people do the right thing, if they know what it is and if it is part of their responsibilities and routines. Mistakes most frequently happen because of misunderstandings, ignorance or neglect. The very best thing that you can do is ensure that your staff are adequately trained. There is no point in giving a junior staff member (incredibly this is most often the case) responsibility for making backups and then not providing training.

In addition to this, it is very difficult to prevent a staff member from carrying confidential information off the premises. How many times have you or one of your staff taken a physical file home to work on? This is incredibly common and incredibly risky. There are better alternatives.

Staff also do vacuous things on their work computers. Creating a culture in which good computer behavior is the standard helps eliminate idle computer usage.

Every law firm sends emails today. Many of these contain your confidential client information, and many of them will have confidential documents attached. Very few law firms will encrypt these emails because recipients won’t be able to open the encrypted data.

So, the reality is that trillions of emails are being sent by lawyers every day containing highly confidential information.

Sending an email to the wrong recipient might even be the single biggest threat to data security, and yet it relies almost entirely on common sense to prevent mishaps.

These are the guys who get all the publicity - usually involving photographs, but sometimes something more serious. In reality of course, the information that a small firm has on its systems is unlikely to be of interest to hackers, unless you specialise in high profile tax evasion crime or the like. There are too many juicy targets out there to make a small firm an attractive target. There is however a risk, and though it might be low commercially, it is particularly important for you from a compliance perspective because your income depends on your practice certificate. The SRA are justifiably concerned, not only about this aspect, but the first three threats as well.

Whilst some are concerned about using cloud software, this concern is often quite misplaced. We have all done online (i.e. cloud) banking for years. Many of us post personal information on Facebook. Cloud software. Many of us post personal information on LinkedIn. Cloud software. We use cloud software all the time, and the good news is that data stored in the cloud in a serious professional way, is far safer than almost every other common data storage mechanism.

Firms typically prefer the idea of having a physical server in their office, or in the office of their IT provider. This seems safe, but potentially riskier. World leading cloud software products run on servers located in secure data centres with the world’s best practice for access not only to the data but to the facilities in which the servers are housed. This is where banks keep their/your data and this is where LEAP keeps your data. It is secure and constantly backed up. With cloud software, the risk of location is eliminated.

LEAP utilises Secure Socket Layer (SSL) and RSA data encryption thereby ensuring that all communication between workstation and server is encrypted and protected from interception. These are two extremely powerful technologies which are also used by financial institutions to protect our data.

In addition to the location security mentioned above, the world’s best practice security controls include industrial strength Firewalls, Anti-virus and Anti Malware detection, Security Patch Management, System Security Hardening , N+1 redundancy and a host of other acronyms that are important but difficult to understand. The important thing is that you don’t need to worry about this anymore. All LEAP Servers are hosted in Amazon Web Services data centres in Dublin. You can get full details of Amazon security controls at http://aws.amazon.com/security. These levels of data security are costly and not realistic for small law firms to host themselves. By using a multi- tenanted cloud product, you enjoy all the advantages of the very best data security available in the world today.

A cloud application cannot protect your workstation and you should always ensure that your system is adequately secured with the latest security updates from a reputable provider with anti-virus, malware detection and firewalls if necessary. Don’t open suspect attachments or download programs from untrustworthy sources. A good policy is not to allow any personal use on work equipment.

You need a secure password, and you need to keep it secret. These are like burglar bars on a house; they keep 95% of potential intruders out. Don’t use:

• 12345
• Password1
• Welcome
• Your initials or date of birth
• Your present or deceased pets' names

Or anything else that is obvious. A simple password is like leaving the front door open.