Module 1
Why lawyers are targets: what attackers want, how they get it and the three things to protect
A lawyer’s desk holds three things that criminals and rivals value: other people’s secrets, other people’s money, and the early knowledge of deals and disputes. Law practices are usually small, busy and trusting, and they are often less protected than the clients whose information they hold. This module explains what attackers want, how they usually get it, and the simple framework (confidentiality, integrity, availability) that lets you describe any security failure in a sentence. It is written for lawyers, not for technicians: no code, no jargon without a plain explanation.
Hover over an idea to light up what it connects to, click it for its definition, minimum requirements, an example and the usual trap, press Play to watch the map build step by step, or trace a short case through it.
Simplified teaching map, in general terms. Check the law where you work. On a small screen, scroll the map sideways.
By the end of this module you can
- Say what attackers want from a law practice and why.
- Name the main kinds of attack and how each works in a sentence.
- Use the three goals of security (confidentiality, integrity, availability) to describe a failure.
- Think about cyber risk as likelihood and impact.
- Describe the human and technical layers of defence.
Part 1. The lecture
What attackers want from a law practice
Attackers are rarely interested in the law itself. They are interested in what lawyers hold or control. Three prizes recur.
| The prize | Why it is valuable | Example |
|---|---|---|
| Client data and secrets | It can be sold, used for blackmail or fraud, or used to gain an advantage over the client. | Medical files in an injury claim, a founder’s personal finances, a company’s draft accounts. |
| Client money | Law practices move large sums (completion funds, settlements, deposits) and the people involved expect instructions by email. | An email that appears to come from the lawyer, giving new bank details for a payment. |
| Early knowledge | Advance notice of a deal, a bid or a dispute is worth money to traders, rivals and negotiators. | A draft merger agreement, a settlement figure, a litigation strategy. |
| The practice itself | A firm that cannot work will pay to work again, and a firm’s reputation is fragile. | Files locked by ransomware on the eve of a hearing. |
Who attacks? Mostly criminals looking for money, in large automated campaigns that do not care who you are. Some are targeted: a competitor, an opposing party or a state interested in a particular client. And some harm comes from inside: a careless colleague, a disgruntled one, or a former employee whose access was never removed. A good security approach covers all three.
The uncomfortable fact
Most successful attacks on law practices do not use clever technology. They use a convincing email, a reused password or a system that was never updated. That is good news: simple habits stop most of them.
The main kinds of attack
| Kind | In a sentence | What it usually targets |
|---|---|---|
| Phishing | A message that tricks a person into clicking a link, opening a file or giving a password. | Credentials and access |
| Business email compromise (BEC) | An attacker takes over or imitates a real email account and asks for a payment or a change of bank details. | Client money |
| Ransomware | Malicious software that locks a practice’s files and demands payment to unlock them, often after copying the data. | Availability, and confidentiality through threats to publish |
| Credential theft and account takeover | Stolen or guessed passwords are used to log in as the user. | Email, document stores, case systems |
| Malware and spyware | Software that spies on or damages a device. | Devices and data |
| Insider misuse or error | A person with legitimate access leaks, copies or sends data wrongly. | Confidentiality |
| Supply-chain compromise | An attacker reaches a firm through a supplier, such as a software vendor or a cloud provider. | Anything the supplier holds or connects to |
| Lost or stolen devices | A laptop, phone or USB drive goes missing. | Data on the device |
| Denial of service | A flood of traffic that makes a website or service unusable. | Availability |
Notice how many of these begin with a person, not a machine. Security is partly a technical subject and largely a human one, and lawyers, who are paid to be careful with words, are often better at spotting a suspicious message than they believe, if they have been taught what to look for (Module 4).
The three goals: confidentiality, integrity, availability
Security people describe the aim of their work with three words, often called the CIA triad. They give you a precise way to say what went wrong.
| Goal | It means | A failure looks like |
|---|---|---|
| Confidentiality | Only the right people can see the information. | A client file is read by an outsider; a draft is sent to the wrong recipient. |
| Integrity | The information is accurate and has not been changed without permission. | An attacker alters the bank details in an invoice; a document is edited and nobody notices. |
| Availability | The information and systems are there when they are needed. | Ransomware locks the case files; a server fails and cannot be restored before a deadline. |
Most incidents touch more than one goal. Ransomware that copies data and locks files harms availability (you cannot work) and confidentiality (the data may be published). A payment-redirection fraud is mainly an integrity failure (the bank details were changed) with a confidentiality failure behind it (the attacker read the emails).
A useful habit
When you hear of an incident, ask three questions: What did it do to confidentiality? To integrity? To availability? The answers tell you which duties are engaged (Module 2) and what to do first.
Thinking about cyber risk
You cannot make a practice perfectly safe, and you do not need to. The practical question is: which risks matter most, and what is a sensible response? The classic way to think about it is to ask two questions of each risk.
- Likelihood: how likely is it to happen to us, given what we do and how we are protected?
- Impact: how bad would it be: for clients, for the practice, for our duties and our reputation?
| Low impact | High impact | |
|---|---|---|
| High likelihood | Fix cheaply and routinely (for example spam, minor phishing). | Top priority: act now (for example payment-redirection fraud, stolen passwords). |
| Low likelihood | Accept, and note it. | Plan and insure: have a response ready (for example a major ransomware attack, a lost laptop with unencrypted files). |
Three responses are open for each risk: reduce it (controls, training), transfer it (insurance, contract terms with suppliers) or accept it knowingly. What is not acceptable is not to have looked. Regulators and courts expect to see that risks were identified and a reasoned decision was made.
A lawyer’s advantage
Lawyers are trained to weigh risk and to write down reasons. A short, dated note of the main cyber risks, the decision on each and who owns it, is the same discipline applied to security, and it is the first thing a regulator, an insurer or a client will ask to see.
Layers of defence: people, process and technology
No single measure stops every attack, so defence is built in layers: if one fails, another still protects. Three layers matter.
| Layer | What it is | Examples |
|---|---|---|
| People | What staff know, notice and do. | Training, a culture in which people report mistakes quickly, a rule to confirm payment changes by phone. |
| Process | The routines and rules the practice follows. | A payment-verification procedure, joiner and leaver checks, backup tests, an incident plan. |
| Technology | Tools that prevent, detect or limit harm. | Multi-factor authentication, encryption, patching, backups, email filtering. |
The strongest layer for a small practice is often the cheapest: a clear rule that nobody changes bank details or releases money on the strength of an email alone. It costs nothing and stops a large share of fraud.
The next modules build the layers one by one: the legal duties that make security a professional obligation (Module 2), the basic controls (Module 3), the human attacks and how to resist them (Module 4), what to do when something goes wrong (Module 5), the law and evidence around cyber incidents (Module 6) and how to run and advise on security in practice (Module 7).
Part 2. Lab: What Is at Stake?
Each situation shows something an attacker could want. Sort it by the main prize.
Situation 1 of 7
An email appears to come from the firm and gives new bank details for a house-purchase payment.
Where does this belong?
Part 3. Lab: Which Goal Failed?
For each incident, choose the goal of security that failed most clearly.
Situation 1 of 4
An attacker alters the account number in a PDF invoice before the client sees it.
Which goal failed most clearly?
Part 4. Check your understanding
Ten questions drawn from a larger pool. Sign in to have your score saved towards your certificate.
You have finished the free module
Here is what you can do now, and where the course goes next
Module 1 gave you
- Say what attackers want from a law practice and why.
- Name the main kinds of attack and how each works in a sentence.
- Use the three goals of security (confidentiality, integrity, availability) to describe a failure.
- Think about cyber risk as likelihood and impact.
- Describe the human and technical layers of defence.
Next, 6 more modules and a capstone
- Module 2: The duties behind security: confidentiality, competence, data protection, contracts and regulationYou will learn to name the five sources of security duty for a lawyer.
- Module 3: The basic controls: accounts, updates, backups, encryption, devices and suppliersYou will learn to explain the core controls and what each one prevents.
- Module 4: Social engineering and payment fraud: phishing, impersonation and the verification habitYou will learn to explain how social engineering uses urgency, authority and trust.
- Module 5: When it goes wrong: ransomware and the first hours of an incidentYou will learn to describe the stages of incident response.
- Module 6: Cyber law and electronic evidence: offences, remedies, forensics and cross-border cooperation
- Module 7: Running security in a practice and advising clients on cyber risk
- Capstone: Capstone: a one-page security review of a small law practice
Each module has its own practice labs and a graded quiz, and a Certificate of Completion follows when you pass them all. The whole course is $15 once, or included in an All-Access Membership.
Two Ways In
Introductory PriceLaw and Cybersecurity: buy it on its own, or get it with All-Access
Unlock all of Law and Cybersecurity on its own with a one-time purchase, or get it as part of an All-Access Membership, which also covers every course and the other paid tools. A member never needs to buy it separately.
This is an early, introductory price for a brand-new product — it’s expected to rise as we add more content. Buy now and it’s yours at today’s rate, forever.
No account needed: you pay, and we email you a one-click sign-in.
All-Access is $19.99 a month or $149 a year, and covers every course and most tools, this one included. Create a free account to subscribe.
Look first, then buy. Free previews on every product page. Secure payment by Stripe. Pay once, keep it forever. Details
See what is included in All-Access →Not ready to buy? Create a free account to save your quiz scores and your place in this course, and to get the printable reports from the practice rooms.
General education on cybersecurity for lawyers, using invented people and situations. It is not legal advice or technical security advice. Laws, professional rules and standards differ between countries and change over time: check the current rules that apply to you and your clients, and take specialist help in a live incident.
Teaching? Share this with your class
Free to use in class. The free parts open for everyone, no account needed.