The practical answer: treat every law-firm mailbox as a privileged access point to client information, not merely as a messaging app. Require multifactor authentication (MFA), prefer phishing-resistant FIDO2/WebAuthn security keys, configure SPF, DKIM and DMARC correctly, maintain effective mail filtering, train people to recognize and report suspicious messages, and keep a tested takeover-response procedure. Match the controls to the sensitivity of your matters, client agreements, applicable law, and the firm’s actual identity and email systems.
No single setting guarantees safety. A small practice can make meaningful progress with a disciplined sequence, while a larger firm may need dedicated identity monitoring, security operations and outside incident-response help.
As an Amazon Associate I earn from qualifying purchases.
Why a law-firm mailbox deserves special protection
Email often contains privileged communications, draft pleadings, settlement positions, personal data, financial details and credentials for other services. If an attacker captures a lawyer’s mailbox, the attacker can read historical conversations, impersonate the lawyer in active matters, reset other accounts and send convincing payment instructions. Phishing can therefore lead to credential compromise, data exfiltration and follow-on activity, not just an unwanted message. Microsoft’s phishing investigation playbook describes those connected stages.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use a risk-based approach. A matter involving trade secrets, health information, a high-value transaction or a client’s contractual security requirements may justify stronger authentication, encrypted delivery, tighter access reviews and more monitoring than a low-sensitivity administrative mailbox. The same principle applies to administrator accounts and mailboxes that can access document systems, practice-management software or trust-account workflows.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
1. Start with identity controls
Require MFA for every relevant account
Enable MFA for all firm email users, administrators, remote-access accounts and identities that can reach sensitive systems. CISA’s business guidance states, “Strong passwords help, but they are no longer enough to keep accounts and systems safe when used alone.” See CISA’s Require Multifactor Authentication guidance and its More than a Password resource.
Do not create exceptions merely for senior lawyers or busy users. An exempt executive account is an attractive route around the firm’s control. If a legacy application cannot use MFA, isolate it, limit its permissions and set a dated remediation plan rather than treating the exception as permanent.
Prefer phishing-resistant FIDO2/WebAuthn
Phishing-resistant authentication validates the legitimate site or service during sign-in, making a stolen password or fake login page far less useful. CISA lists a physical security key as its strongest option for business MFA. A FIDO2/WebAuthn hardware key is a practical example, but it is only one part of a firm-wide plan.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Before purchasing keys, confirm that the firm’s identity provider and email service support the required standard, that the operating systems and browsers used by staff are compatible, and that the key can be used on the firm’s managed devices. Decide how many keys each person receives, where the spare is stored, who can replace a lost key, and how a new or departing employee is enrolled or removed. Recovery that silently falls back to an unprotected method can undermine the benefit of the key.
Use the strongest available fallback
Some organizations cannot deploy security keys immediately. CISA places number-matching authenticator prompts above ordinary push approval and identifies them as a more secure interim choice when phishing-resistant methods are unavailable. Authenticator one-time codes, biometrics used with another factor, and text or email codes provide progressively less protection in CISA’s listed hierarchy. Do not describe SMS codes as equivalent to a security key; use them only when stronger methods are not yet supported and set a migration date.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Method | Phishing resistance | Deployment and recovery considerations |
|---|---|---|
| FIDO2/WebAuthn hardware security key | Highest among the listed business options | Check identity-provider, device and browser support; issue a spare and document replacement and account-recovery procedures. |
| Number-matching authenticator prompt | Stronger interim protection than a simple push approval | Requires a compatible authenticator and user training; still needs a secure recovery path. |
| Authenticator one-time code | Better than password-only access, but a code can be phished | Plan for lost or replaced phones and protect the enrollment process. |
| Biometric factor used with another factor | Depends on the accompanying factor and device implementation | Review device support, privacy implications and account-recovery options. |
| Text or email code | Weakest of the listed methods | Use only as a temporary or compatibility fallback while moving to a stronger factor. |
When comparing methods, weigh phishing resistance, compatibility, user friction, recovery, administrative manageability and the sensitivity of the mailbox. A method that staff can reliably use is preferable to a stronger control that is routinely bypassed, but convenience should not be the sole design criterion.
2. Harden the domain and mail flow
Implement SPF, DKIM and DMARC deliberately
SPF identifies servers authorized to send mail for the firm’s domain. DKIM adds a cryptographic signature that receiving systems can verify. DMARC tells receiving systems how to handle messages that fail alignment checks and gives the domain owner reporting visibility. Together, they reduce spoofing and expose misconfigured or unauthorized senders.
Recommended Free Tools
Inventory every legitimate sender before enforcing a strict DMARC policy: the primary mail platform, case-management notifications, billing services, marketing systems, court-filing tools and any outside provider that sends as the firm. Start by monitoring reports, correct SPF and DKIM alignment problems, and then tighten enforcement in stages. A technically incorrect DNS record can block legitimate messages, so have the mail administrator or a qualified provider review the records and reports for the firm’s actual domain.
CISA’s phishing guidance and its Exchange Online Security Configuration Benchmark cover phishing defenses and mail-configuration considerations.
Review bypasses and routing exceptions
Mail-flow rules, connectors, allow-lists and third-party gateways can unintentionally bypass spam filtering or SPF, DKIM and DMARC checks. CISA notes that Exchange Online bypasses may skip protections. Review every exception at least periodically, record its owner and business reason, restrict it to the narrowest possible scope, and remove rules that no longer have a documented purpose.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep anti-spam, anti-malware and attachment scanning enabled. External-message banners can help users notice that a message originated outside the firm, but a banner is a cue, not a verdict: legitimate client mail can be external and a compromised client account can appear familiar. Configure quarantine and release permissions so users do not routinely approve suspicious mail without review.
Protect administrator and service identities
Separate day-to-day lawyer accounts from global administrator accounts. Require strong MFA for administrators, limit the number of people with tenant-wide rights, and use dedicated admin identities where the platform supports them. Review service accounts and application registrations, remove unused credentials, rotate secrets according to the service’s capabilities, and grant only the permissions each integration needs.
3. Make safe behavior easy for staff
Teach the signals that matter
Training should use realistic examples from legal work and explain the action to take, not merely show a list of scary screenshots. Ask staff to pause when a message includes:
- A sender address or domain that imitates a legitimate organization or differs by a small spelling change.
- A displayed link whose destination does not match the text or the expected service.
- An unexpected attachment, especially a document that asks the user to enable content, sign in or change security settings.
- An urgent request for credentials, multifactor approval, wire instructions, gift cards or a change to trust-account information.
- Pressure to bypass normal review, secrecy about the request, or an unusual tone from a familiar contact.
CISA’s StopRansomware Guide and its Phishing General Security Postcard provide awareness and reporting guidance.
Provide a one-step reporting route
Every user should know exactly how to report a suspicious message: a built-in report button, a monitored security mailbox or a phone/ chat route for urgent events. Make the route visible in onboarding and the email client. Tell users not to forward a live malicious link to a large distribution list. Security staff can preserve the original message and headers in the approved reporting system.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Reward prompt reporting rather than blaming the person who clicked. Fast reporting gives the administrator a chance to remove the message from other mailboxes, block indicators and investigate sign-ins before an attacker expands access.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Verify payment and trust-account changes independently
For payment instructions, wire details, settlement disbursements or trust-account changes, require verification through a known telephone number, a previously established client contact or another channel already on file. Do not reply to the message or use contact details supplied in it. This is a prudent operational control for business-email-compromise risk, not a guarantee that fraud is impossible.
4. Protect client information sent by email
Match delivery controls to the matter
Decide when ordinary email is appropriate and when the matter calls for a secure portal, encrypted message, protected file transfer or another documented method. Consider the information’s sensitivity, the client’s instructions, contractual terms, applicable privacy or sector rules, recipient identity and the risks of forwarding or misdelivery. Make the approved method easy to use; otherwise staff may create their own workarounds.
Confirm external recipients before sending, use the platform’s delayed-send or recall features only as supplemental aids, and avoid placing unnecessary sensitive details in subject lines. A secure delivery method does not excuse checking the recipient address or reviewing attachments.
Apply the professional-ethics standard in context
ABA Formal Opinion 477R, revised May 22, 2017, states:
“A lawyer generally may transmit information relating to the representation of a client over the internet without violating the Model Rules of Professional Conduct where the lawyer has undertaken reasonable efforts to prevent inadvertent or unauthorized access. However, a lawyer may be required to take special security precautions to protect against the inadvertent or unauthorized disclosure of client information when required by an agreement with the client or by law, or when the nature of the information requires a higher degree of security.”
Best Value
Thetis FIDO2 Security Key (USB-A, 2-Pack) - Hardware MFA & Passkey Access for Business, School ERP & Employee Accounts | Compatible with Windows, Google Workspace, Apple ID, Coinbase, Salesforce
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Read the opinion at the American Bar Association’s Formal Opinion 477R. It is professional-ethics guidance, not jurisdiction-specific legal advice and not a mandate for one universal email product, encryption method or security-key model. Sensitive matters, client agreements and law can require precautions beyond the firm’s baseline. ABA materials also emphasize competent safeguards, appropriate assistance, supervision and periodic review as technology and threats change; see Cybersecurity for Attorneys: Back to the Basics and Cybersecurity for Attorneys: Ethically Avoiding Fraud and Scams.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Prepare for a suspected account takeover
Write the procedure before an incident and name the person who can administer the email and identity platform. Include a backup administrator, the firm’s incident lead, outside counsel or insurer contacts where applicable, and a secure out-of-band communication method in case email is untrusted.
- Contain the immediate risk. If a user entered credentials into a suspicious page, stop further interaction, disconnect an affected endpoint when appropriate, and contact the identity or email administrator through a trusted channel.
- Preserve evidence. Save the original message, headers, URLs, attachment details, timestamps and relevant endpoint information. Avoid deleting the only copy before the administrator can examine it.
- Investigate sign-ins and mailbox activity. Review identity logs for unfamiliar locations, devices, impossible travel patterns or unusual authentication events. Inspect mailbox audit records for reads, sends, deletions, search activity, forwarding, inbox rules and changes to delegate access.
- Check OAuth and token activity. Identify recent application-consent grants, unfamiliar applications and active sessions or refresh tokens. Remove unauthorized consent and revoke sessions and tokens according to the platform’s administrative procedures.
- Reset exposed credentials safely. Change the password from a trusted device, reset other credentials that reused it, require MFA re-registration when necessary, and invalidate existing sessions. Do not rely on a password change alone if tokens or application access remain active.
- Remove malicious mail. Search for and purge the phishing message and related variants from other mailboxes where the platform permits. Block confirmed malicious domains, URLs, senders or hashes without creating an overbroad rule that blocks legitimate client communications.
- Inspect endpoints and connected services. If a user opened an attachment or installed software, have the endpoint assessed. Review browser extensions, saved credentials, remote-access tools and connected applications for unauthorized changes.
- Assess what was accessed. Determine which messages, attachments, contacts, credentials and downstream systems may have been viewed or altered. Preserve a timeline and record decisions.
- Escalate and communicate. Follow the firm’s incident, client-communication, insurance, contractual and jurisdictional requirements. Use a trusted channel to coordinate with affected clients and authorities when counsel or applicable rules require it.
Microsoft’s Phishing investigation playbook provides a platform-specific investigation sequence. ABA guidance references Formal Opinion 483 for duties after a breach, but notification deadlines and legal obligations depend on the facts and jurisdiction; obtain jurisdiction-specific advice rather than assuming one universal deadline.
6. A manageable implementation plan
First 30 days: close the obvious gaps
- Inventory every mailbox, administrator, shared mailbox, forwarding rule, external sender and identity integration.
- Turn on MFA, beginning with administrators and high-value accounts, and disable legacy authentication where the platform allows it.
- Publish the reporting route and the independent-verification rule for payment changes.
- Review active forwarding, delegate access, OAuth grants and mail-flow bypasses for obvious anomalies.
- Confirm that backups, incident contacts and administrator recovery details are available outside the email system.
Days 31–60: improve resistance and visibility
- Deploy FIDO2/WebAuthn keys where supported and issue spares under documented custody.
- Inventory legitimate senders and begin SPF, DKIM and DMARC monitoring; correct alignment failures before enforcement.
- Review anti-spam, anti-malware, attachment and external-sender controls.
- Run a short, role-specific exercise involving a fake credential request and a payment-change scenario, measuring reporting time rather than click counts alone.
Days 61–90: test and govern
- Tighten DMARC enforcement after legitimate senders are accounted for, with a rollback plan for misconfiguration.
- Test the takeover runbook, including token revocation, mailbox searches, endpoint assessment and client-communication decisions.
- Review administrator privileges, service accounts, application consent and recovery methods.
- Document exceptions, owners, review dates and the evidence used to decide whether stronger protections are required for particular matters.
7. Decide whether to use outside security support
A qualified managed cybersecurity or IT provider can help a firm that lacks identity expertise, monitoring coverage or incident-response capacity. Evaluate providers against the firm’s needs rather than selecting on a logo or a generic checklist.
| Evaluation area | Questions to ask |
|---|---|
| Legal and professional-services experience | Have they handled privileged communications, conflicts concerns, trust-account workflows and confidentiality obligations? |
| Coverage hours | Who responds nights, weekends and holidays, and what is the guaranteed escalation path? |
| Incident-response scope | Will they investigate identity, mailbox, endpoint and OAuth activity, preserve evidence and coordinate with counsel or an insurer? |
| Platform expertise | Can they administer the firm’s actual email, identity provider, devices, DNS and mail-flow tools? |
| Data handling and confidentiality | Where are logs and message samples stored, who can access them, and how are subcontractors governed? |
| Reporting and escalation | What alerts, reports, response times and decision records will the firm receive? |
| Cost and scope | Which users, devices, hours and incident activities are included, and what incurs an additional charge? |
Even with outside help, the firm retains responsibility for deciding its risk tolerance, client commitments and legal-ethics response. Put roles, access permissions, confidentiality terms and handoff procedures in writing.
Quick Recap
Common mistakes that leave firms exposed
- Relying on passwords plus a security question: a phishing page can capture both. Require MFA and move toward phishing-resistant methods.
- Approving an unexpected push: deny it and report the event; repeated prompts can be an attempt to wear down the user.
- Using a broad allow-list: a bypass for one sender or connector can disable several protections. Scope and review every exception.
- Publishing DMARC without an inventory: legitimate court, billing or practice-management mail can fail if its sender is not accounted for.
- Assuming an external banner solves impersonation: banners do not authenticate a sender or verify a payment request.
- Resetting a password and stopping: active sessions, OAuth grants, forwarding rules and stolen tokens can preserve attacker access.
- Leaving recovery undocumented: a lost security key, unavailable administrator or compromised recovery address can force an unsafe fallback.
- Training once and never testing: staff need a simple reporting path and periodic practice tied to the firm’s actual workflows.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
