Those of you who followed Jim Calloway’s work may remember The Digital Edge: Lawyers and Technology, the podcast he co-hosted with Sharon Nelson for 16 years. I even had the pleasure of appearing on it once. Ms. Nelson and her colleagues Michael Maschke and John Simek have written an excellent article for Above the Law called “The Cybersecurity Control Money Can’t Buy.”

I am going to strongly encourage you to read the entire article. Really. Read the whole thing. It is not long.

The authors discuss recent cyberattacks involving some of the largest and most sophisticated law firms in the world. These firms had substantial cybersecurity budgets and access to the best technology available. Yet, in some instances, the attackers did not have to defeat that technology. They simply convinced an employee to provide credentials, approve access or send documents to someone who was not who they claimed to be.

That is the part every law office should think about.

Firewalls, multi-factor authentication, email filtering and other cybersecurity tools are essential. But they cannot fully protect a firm when someone posing as an IT technician, managing partner, vendor or important client creates a sense of urgency and persuades an employee to act before stopping to verify the request.

The three authors offer practical advice: Make verification routine. Employees should know how to verify unexpected requests involving passwords, multi-factor authentication, remote access, financial transactions or confidential documents. They should feel free to pause and ask questions, even when the requester appears important.

Protecting client information and law firm funds requires good technology, but it also requires good procedures and a workplace culture that does not punish someone for pausing to verify an unusual request.

The article ends with perhaps the most important cybersecurity question anyone in a law office can ask: “How do I know you are who you say you are?”

Please take a few minutes and read the entire article. Then consider whether everyone in your office knows what to do the next time that question needs to be asked.