Storage & Security

Destruction May Lurk Behind Your Files

By David Whelan

LAWYERS HAVE never before had so many options for constant access to the Internet. Cable and digital subscriber lines (DSL) offer two of the most economical routes to fast Internet connections. In fact, a 2001 American Bar Association survey indicated that nearly one-third of lawyers who access the Internet used either a DSL or cable connection.

Both options provide high-speed connections and the ability to share a single connection among all the computers on a local area network (LAN). But the price of this business-friendly Internet access is increased susceptibility to external attacks. Cable and DSL Internet connections are "always on," meaning that the modem is always turned on, waiting for communications. The modem does not dial-up to the Internet each time you wish to receive mail or search the Web. "Always on" connections give intruders time to find holes in your law firm's defenses.

But never fear: You may be able to thwart attacks by taking proactive steps to protect your network.

Firewall

The first and most important line of defense is your firewall. This may be a software application that intercepts attempts by others to communicate with your computer. Hardware firewalls operate separately from a computer but also intercept incoming and outgoing computer communications. Free firewall software is available but you should really invest in as much protection as your budget allows due to the sensitivity of your client data and work product. Dedicated hardware firewall prices start at a few hundred dollars. Other network hardware, such as routers, can perform some of the basic firewall functions.

DSL or cable modems connected to a router may support network address translation (NAT). Your internal computers can hide behind NAT, using addresses that external computers cannot reach. The router can appear to be invisible to external probing. If a hacker tries to find you by poking where she thinks you are, and gets no response, she will move on to a network that does respond. The router can also accept certain requests -- to your e-mail or Web server, for example -- while blocking other traffic. It is imperative that the firewall watch traffic going both ways. Microsoft's Internet Connection Firewall in Windows XP, for example, only monitors incoming traffic. If a virus on a floppy disk infected your computer and began sending out information through your Internet connection, the Windows XP firewall will not warn you. A firewall should be able to block internal network computers from accessing the Internet as well as blocking external ones.

Remember, though, that firewalls are only the first line of defense. A seemingly valid request can bypass the firewall and still deliver its payload -- a virus or an unauthorized software program. Once firewall is in place, ensure that your computers are monitoring the traffic they receive. Where possible, place a software-based firewall on every computer to block internal attacks. A virus on a floppy disk can inflict as much internal damage as one that comes through your Internet access point.

Anti-virus Software

Anti-virus software on every computer is a necessity in every law office. Once installed, configure it so the computer user cannot disable it. You cannot anticipate when the next virus attack will occur so automate the update of the virus software. Most major products will automatically download the latest data files that fend off viruses. The anti-virus software updates all of your network computers with the downloaded files and you do not have to rely on human intervention, which might fail if your staff goes on vacation or is sick.

These are the first steps to protecting your network, your data, and your own, and your client's, piece of mind. Training is inseparable from using technology to bar the door and you must be vigilant and train your staff and lawyers to be wary of all e-mail attachments and of programs on Web sites that ask to install files. Someone in the firm should review on, a regular basis, the firewall and network log files to see if anyone is gaining access without your knowledge.

Take proactive steps and turn your vigilance into standard office practice. You will be able to take advantage of your "always on" connection secure that your technology is working for you.

David Whelan is director of the Legal Technology Resource Center for the American Bar Association.