iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure a law firm’s email by treating every mailbox as a sensitive access point: require strong, preferably phishing-resistant MFA; authenticate the firm’s domain with SPF, DKIM, and DMARC; keep filtering and safe mail-flow rules in place; train staff to report suspicious messages; and maintain a practiced account-takeover response. The right controls depend on the information handled, client agreements, applicable law, and the firm’s actual identity and email systems.
Why law firm email needs stronger protection
A compromised mailbox can expose privileged communications, disclose matter details, and give an attacker a trusted identity for targeting clients, opposing counsel, vendors, or firm staff. Phishing is often the first step: a victim follows a link, enters a password, approves an unexpected sign-in, or opens a malicious attachment. The attacker can then read conversations, search for payment instructions, create forwarding rules, obtain additional credentials, or use the account to send convincing messages.
Microsoft’s Phishing investigation playbook connects phishing investigations with credential compromise, data exfiltration, and follow-on activity. That is why email security is an identity, data-protection, and incident-response issue—not merely a spam-filtering problem.
The American Bar Association’s Formal Opinion 477R describes a reasonableness standard rather than a universal product requirement. It also recognizes that some matters call for special precautions. A small practice handling routine matters may not need the same controls as a firm handling highly sensitive investigations, health information, financial records, or contractual confidentiality obligations.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
1. Start with identity controls
Require MFA for every important account
Require multifactor authentication (MFA) for all firm email users, administrators, and accounts that can reach document systems, billing, practice-management tools, remote access, or security settings. Include shared administrative identities and service accounts where the platform supports an appropriate interactive or workload-authentication method. Remove or disable accounts that no longer have a business owner.
CISA states that “Strong passwords help, but they are no longer enough to keep accounts and systems safe when used alone.” Its business MFA guidance recommends MFA for business accounts and identifies phishing-resistant methods as the strongest direction.
Choose the strongest method the platform supports
The methods below follow the relative ordering described in CISA business guidance. Resistance to phishing, compatibility, recovery, and administrative workload all matter; a method that users cannot reliably use or recover is not a complete control.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Method | Phishing resistance | Deployment and user considerations | Recovery and administration |
|---|---|---|---|
| FIDO2/WebAuthn hardware security key | Strongest option listed by CISA when correctly implemented | Requires support from the identity provider, mail service, browsers, operating systems, and user devices; users carry a physical key | Plan for at least one registered backup method or spare key, secure enrollment, replacement, and lost-key procedures |
| Number-matching authenticator prompt | More resistant to push-approval fatigue than a simple approve/deny prompt, but not equivalent to a security key | Usually easier to deploy through a mobile authenticator; users must compare the displayed number | Document device replacement, account recovery, and what the help desk must verify before resetting MFA |
| Authenticator one-time code | Better than a password alone, but a code can be entered into a fraudulent site | Works where an authenticator app is supported; users must protect the enrollment secret and device | Maintain a controlled recovery process and re-enrollment procedure |
| Biometric unlock | Usually an additional factor used with a device or cryptographic credential, not a standalone guarantee | Convenient on supported devices; availability varies by hardware and operating system | Provide a non-biometric recovery path that is protected to the same standard |
| Text or email code | Weakest end of CISA’s listed methods; vulnerable to interception, redirection, or compromised email | Broad compatibility but should not be presented as equivalent to a phishing-resistant key | Use only when stronger choices are unavailable, while planning migration |
When phishing-resistant MFA is unavailable, use the strongest supported option. CISA identifies number matching as a more secure interim choice than a simple push approval. Do not describe SMS or email codes as equivalent to a security key.
Deploy MFA without locking out the firm
- Inventory identities. List every mailbox, administrator, former-user account, shared address, forwarding identity, and application with access to email or the identity provider. Assign an owner to each account.
- Confirm platform support. Check whether the firm’s email provider, identity service, operating systems, browsers, mobile devices, and remote-access tools support FIDO2 or WebAuthn. Test the complete sign-in path, including private browsing, phone replacement, and offline or travel scenarios.
- Protect enrollment. Restrict who can register a new authenticator, require verification of the user’s identity, and record which keys or devices are assigned. Do not let a help-desk reset silently bypass the same controls the firm is trying to enforce.
- Provide a recovery design. Decide how a lost key, stolen phone, departed employee, or unavailable administrator is handled. Store spare keys securely, define dual approval for sensitive resets, and test the process before making MFA mandatory.
- Roll out in groups. Start with administrators and high-risk accounts, then move through the rest of the firm. Keep a documented exception process with an owner and an expiration date rather than allowing permanent bypasses.
- Review sign-in alerts. Establish who receives alerts for unusual locations, new devices, repeated failures, or changes to authentication methods. An alert has value only when someone is responsible for investigating it.
2. Authenticate the domain and control mail flow
Implement SPF, DKIM, and DMARC deliberately
SPF identifies authorized sending infrastructure, DKIM adds a verifiable signature to messages, and DMARC lets the receiving system evaluate alignment and apply a policy. Together they reduce domain spoofing and provide visibility into legitimate and unauthorized senders. They do not stop every malicious message, especially when an attacker uses a look-alike domain or a legitimate compromised account.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Inventory every service that sends as the firm or its subdomains before changing DNS: the primary mail platform, case-management notifications, billing systems, newsletters, e-filing tools, scanners, and any outside service authorized by the firm. An incomplete inventory can cause legitimate mail to fail when enforcement is tightened.
- Document senders and domains. Record which systems send mail, which domains they use, and who can change their configuration.
- Publish and verify SPF. Authorize only the services that genuinely send for the relevant domain. Check for duplicate or oversized records and verify that the platform’s documented design is followed.
- Enable DKIM. Generate and publish the provider’s signing records, then confirm that outbound messages are actually signed and that signatures align with the visible From domain where required.
- Start DMARC monitoring. Use a monitoring policy while reviewing aggregate results. Identify legitimate senders, forwarding behavior, and third-party services before moving to a stricter enforcement policy.
- Tighten in stages. After legitimate sources are accounted for, increase enforcement according to the firm’s risk tolerance and mail-flow evidence. Have the mail administrator or a qualified provider review the change; a technically incorrect policy can disrupt important messages.
- Recheck after changes. Repeat verification when the firm changes email providers, adds a vendor, acquires a domain, or changes routing.
CISA’s phishing guidance and its Exchange Online Security Configuration Benchmark emphasize authentication and configuration hygiene. Use the controls as a system, not as a one-time DNS task.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Keep filtering and routing protections active
Retain anti-spam and anti-malware controls, and consider clearly marking messages that originate outside the firm when that helps users recognize impersonation. Review transport rules, connectors, allowlists, and vendor routes regularly. A broad bypass can let a message skip spam filtering or SPF, DKIM, and DMARC checks. Every exception should have a business owner, a narrow scope, and a review date.
Use separate, documented administrative access for mail-flow changes. A compromised ordinary mailbox should not automatically give an attacker the ability to weaken the entire domain’s protections.
3. Give people a usable reporting path
Teach recognizable phishing indicators
Training should use the firm’s real workflows and explain what to do, not merely tell users to be careful. Cover:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- sender addresses that imitate a client, court, bank, vendor, or colleague;
- links whose destination does not match the displayed text or expected service;
- unexpected attachments, especially documents that request macros, passwords, or unusual permissions;
- urgent requests for credentials, gift cards, wire transfers, trust-account changes, or confidential files;
- messages that create pressure, secrecy, or fear of disciplinary or financial consequences;
- unexpected MFA prompts or sign-in notifications; and
- requests to move a conversation to a new address or channel without an independent explanation.
CISA’s StopRansomware Guide and phishing postcard recommend awareness and reporting procedures. Make reporting easy: provide a built-in report-phishing control, a monitored security alias, or a ticket route, and tell users which option to use. The route must be monitored during the hours when the firm conducts business.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify financial and trust-account changes independently
For payment instructions, wire details, settlement funds, trust-account changes, or a request to release sensitive documents, verify through a known telephone number or previously established contact—not by replying to the suspicious message or using contact details supplied in it. Record who performed the verification and when. This is a prudent business process, not a guarantee that business-email-compromise attempts will fail.
Ask staff to report quickly even if they clicked a link or entered information. Delayed reporting gives an attacker more time to use a session, alter mail, or send convincing follow-up messages.
4. Match client-information protections to the matter
Email security decisions should follow the sensitivity of the information and the firm’s obligations. ABA Formal Opinion 477R does not mandate one universal email product, encryption method, or security-key model. It says that reasonable efforts are generally sufficient for ordinary internet transmission, while agreements, law, or the nature of the information can require special precautions.
| Situation | Questions to answer | Possible control direction |
|---|---|---|
| Routine correspondence with no unusual sensitivity | Is the recipient verified, and are the firm’s baseline MFA, filtering, and domain controls operating? | Use the firm’s approved email workflow and keep ordinary attachments and recipients within policy. |
| Confidential matter information or contractual restrictions | Does the engagement letter, outside counsel guideline, protective order, or client policy specify encryption, portals, retention, or approved vendors? | Use the required encrypted message or secure portal, restrict sharing, and document the approved process. |
| Highly sensitive, regulated, or unusually damaging information | Would disclosure cause serious harm, and do applicable laws or professional obligations call for stronger safeguards? | Obtain informed guidance from the responsible lawyer and security administrator; use a stronger approved channel and minimize the information sent by ordinary email. |
| Unknown or unverified recipient | Can the identity and address be confirmed independently? | Pause transmission until verification is complete, especially for privileged or financial information. |
Limit the amount of sensitive information placed in an email subject line, use the minimum necessary attachment, verify recipients before sending, and know how long messages and attachments are retained. These practices complement technical controls but do not replace the firm’s confidentiality and records policies.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Respond methodically to a suspected account takeover
Prepare a written procedure before an incident. Name the incident lead, the email and identity administrator, the responsible lawyer or managing partner, the person who coordinates client communications, and the insurer or outside responders to contact. Keep emergency contact details available outside the potentially compromised mailbox.
Immediate containment and investigation
- Preserve the report and evidence. Keep the original message, headers, screenshots, reported URL, attachment, timestamps, and the user’s description. Avoid deleting the only copy before the administrator can examine it.
- Identify the scope. Determine which user interacted with the message, what credentials or information were entered, whether an attachment was opened, and whether other recipients received the same message.
- Review identity activity. Examine sign-in logs, unfamiliar devices, unusual locations, authentication-method changes, and other alerts. Check whether an attacker obtained an active session rather than only a password.
- Check mailbox activity. Look for forwarding rules, hidden inbox rules, deleted or sent messages, unusual searches, mass downloads, and messages sent from the account. Attackers commonly use rules or forwarding to maintain access and hide replies.
- Review OAuth and application access. Identify unexpected consent grants, newly authorized applications, refresh-token activity, or integrations that can read mail. Remove unauthorized grants and revoke affected tokens.
Eradication and recovery
- Reset exposed credentials. Change the affected password and any reused password. Use a clean device or trusted administrative path when compromise of the endpoint is possible.
- Revoke sessions and tokens. Sign out active sessions and invalidate refresh tokens according to the identity platform’s controls. Changing a password alone may not terminate an already established session.
- Remove malicious messages. Search for and remove the phishing message and related copies from affected mailboxes, while preserving the evidence needed for investigation and reporting.
- Block known indicators. Add malicious domains, URLs, senders, hashes, or other indicators to the appropriate mail and endpoint controls after confirming that the block will not disrupt legitimate business.
- Assess endpoints. If a user opened an attachment, installed software, or entered credentials into a suspicious page, examine the device with the firm’s endpoint and security procedures before returning it to normal use.
- Restore safely. Remove unauthorized rules and applications, re-enroll MFA if necessary, confirm that the mailbox and domain settings are correct, and monitor the account for renewed activity.
Escalate and communicate carefully
Preserve logs and other evidence in accordance with the firm’s incident, insurance, contractual, and client-communication requirements. Determine whether privileged information, personal information, funds, or third-party systems were affected. Coordinate notifications with the responsible lawyer, insurer, incident responder, and applicable authorities as appropriate. Do not announce a legal deadline based solely on a generic checklist; notification duties depend on the facts, jurisdiction, contracts, and the information involved.
ABA cybersecurity guidance references Formal Opinion 483 for duties after a breach. Review the applicable opinion and jurisdiction-specific requirements with qualified counsel. Inform affected clients through a trusted channel, not through the potentially compromised mailbox, and explain what is known, what actions were taken, and what recipients should do.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Apply the legal-ethics standard to real decisions
A lawyer generally may transmit information relating to the representation of a client over the internet without violating the Model Rules of Professional Conduct where the lawyer has undertaken reasonable efforts to prevent inadvertent or unauthorized access. However, a lawyer may be required to take special security precautions to protect against the inadvertent or unauthorized disclosure of client information when required by an agreement with the client or by law, or when the nature of the information requires a higher degree of security.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
This passage is from the American Bar Association’s Standing Committee on Ethics and Professional Responsibility, Formal Opinion 477R, revised May 22, 2017. It is professional-ethics guidance, not a substitute for jurisdiction-specific legal advice.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
For governance, document why the firm selected its controls, who reviews alerts, how exceptions are approved, and when the program is reassessed. The ABA’s December 2025 cybersecurity basics guidance emphasizes competent safeguards, appropriate assistance, supervision, and review as technology and threats change. The firm’s security program should therefore be revisited after a provider change, major incident, new client requirement, or material change in the types of matters handled.
7. Verify that the controls are actually working
A policy is not evidence of protection. At a defined review interval, obtain evidence that:
- every active user and administrator is enrolled in MFA;
- phishing-resistant methods are available to the accounts that need the highest protection;
- recovery methods and spare keys are controlled and tested;
- SPF, DKIM, and DMARC results show the firm’s legitimate senders;
- mail-flow exceptions, connectors, allowlists, and forwarding rules have owners;
- users know how to report suspicious mail and receive a timely response;
- sign-in, audit, mailbox, OAuth, and mail-flow logs are retained long enough for investigation;
- the incident procedure contains current contacts and has been rehearsed using a safe scenario; and
- client agreements and matter-specific requirements are reflected in the firm’s approved communication methods.
Keep a record of unresolved gaps, the person responsible, the intended completion date, and the risk accepted by firm leadership. A documented exception is safer than an invisible one.
8. When to use outside security help
A law firm may need a qualified managed cybersecurity or IT provider when it lacks identity-platform expertise, continuous monitoring, reliable incident response, or the capacity to review mail-flow configuration. Evaluate a provider on the work it will actually perform rather than on a generic security label.
| Evaluation area | Questions for the firm |
|---|---|
| Relevant experience | Has the provider worked with law firms or professional-services environments where confidentiality and privilege matter? |
| Coverage | Which hours are monitored, and what happens nights, weekends, holidays, and during a firm-wide outage? |
| Incident response | Will it investigate sign-ins, mailbox rules, OAuth grants, tokens, endpoints, and affected messages, or only reset passwords? |
| Platform expertise | Can it administer the firm’s actual identity provider, email service, DNS, filtering, devices, and logging tools? |
| Confidentiality and data handling | Where will logs or message samples be stored, who can access them, and what contractual protections apply? |
| Escalation and reporting | Who is contacted during a suspected takeover, how quickly, and what written report will the firm receive? |
| Cost and scope | Which services are included, which are billed separately, and what assumptions could create additional charges? |
Require the provider to explain its recovery and evidence-preservation process before an incident occurs. Do not grant broad standing access without documenting the purpose, least-privilege permissions, approval process, and termination procedure.
Quick Recap
Common failure modes and fixes
| Symptom | Likely cause | Corrective action |
|---|---|---|
| Users receive repeated MFA prompts and approve one to make them stop | Simple push approval is being abused or users do not recognize unexpected prompts | Move to number matching or phishing-resistant MFA where supported, train users to report unexpected prompts, and investigate the account if one was approved. |
| Legitimate client or vendor mail fails after DMARC enforcement | An authorized sender or forwarding path was not included in the inventory or is not aligned | Review DMARC reports and the sender’s DKIM/SPF configuration with the mail administrator; correct the source before changing policy broadly. |
| Users ignore the external-message banner | The banner is too frequent, unclear, or not connected to a reporting action | Make the warning concise, explain the specific behavior expected, and pair it with a one-step reporting route. |
| A password reset does not stop suspicious activity | Existing sessions, refresh tokens, OAuth grants, forwarding rules, or malicious applications remain active | Revoke sessions and tokens, remove unauthorized applications and rules, and review sign-in and mailbox logs. |
| A phishing message was deleted before anyone investigated | Staff were told only to delete suspicious mail | Teach users to report first through the approved channel and preserve the original message or headers when safe to do so. |
| A security vendor can access sensitive logs without clear limits | The contract does not define data handling, retention, access, or escalation | Clarify confidentiality terms, permissions, storage, subcontractors, reporting, and access removal before onboarding. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
