Cyber security for professional firms
A firm holds the secrets of dozens or hundreds of clients, and almost always holds them in a mailbox. That is where it pays to begin.
Cyber security for law firms and accountants: the data belongs to clients
An attacker who gets into a firm does not find only the firm's own data. They find balance sheets, tax returns, payslips of client companies, court documents, expert reports, designs. Information security in a professional firm is therefore a matter of trust: whoever entrusts you with a case takes it for granted that it stays confidential.
A small firm also has a convenient profile for attackers. Few people, no in-house IT department, a technician called in when needed, a lot of communication with the outside and many payments passing through email: fees, F24 tax payment forms for clients to pay, filings, advances.
That is why the most frequent attack is not the virus that encrypts the server, but the compromised mailbox. A reused password and a login without a second factor are enough.
Payment fraud, step by step
It is called business email compromise. Nothing needs to be installed: it is enough to read someone else's email for a few weeks.
The access
A member of staff enters her Microsoft 365 password on a page that imitates the login page, or her password has already ended up in a list of stolen credentials.
The wait
The attacker creates a rule that forwards or hides certain messages, and silently watches deadlines, amounts and contacts.
The strike
At the right moment the client receives, from the firm's real mailbox, an email with an "updated" IBAN. The transfer goes to an account that disappears within a few days.
PEC is no exception. A compromised PEC mailbox (Italian certified email, with legal value) sends messages that are legally binding in the firm's name, and can receive notices that no one reads. Its credentials deserve the same attention as those of ordinary email.
Professional secrecy, the GDPR and clients who ask for assurances
- Professional secrecy. Disclosure of professional secrets is a criminal offence in Italy (Article 622 of the Italian Criminal Code) and the codes of conduct of the professional bodies require confidentiality. A data leak caused by negligence is hard to explain to a client and to your own professional body.
- GDPR. The firm is the controller for its own data and often a processor on behalf of clients, as a payroll consultant is with payslips. You need records of processing, appointments for staff and appropriate security measures.
- Data breaches. A compromised mailbox with client data is a breach to be assessed immediately: notification to the Garante (the Italian Data Protection Authority) must be made within 72 hours, when there is a risk to people.
- Anti-money laundering. Accountants and lawyers keep clients' identification and due diligence documents: exactly the kind of data used for identity theft.
- Clients subject to NIS2. Firms are not normally directly in scope of NIS2, but their larger clients are: for them you are a supplier that handles confidential data, and they send you questionnaires on supply chain security.
- System administrators. The external technician who manages the firm's server falls under the Italian Garante's order on system administrators: they must be appointed and their access logged.
Five controls for a professional firm
A few services, chosen according to where the firm's data actually flows.
Email, first of all
The Microsoft Entra ID tenant assessment checks 72 indicators, read-only: two-step verification, privileged accounts, authorised apps and suspicious mail rules, the same ones used in payment fraud. For those who use Google there is Google Workspace, with SPF, DKIM and DMARC read from DNS.
Passwords already exposed
Dark Web Monitoring searches for addresses on the firm's domain in an archive of more than 14 billion compromised credentials and alerts you when a new one appears.
People
Simulated phishing campaigns prepared and launched by Dottor Marc with Cyber Awareness, and courses with an exportable record through Training.
The case archive
Open shares shows which client folders can be read by anyone who connects to the firm's network, guests included.
Privacy documents
GDPR forms generates appointments and engagement letters for staff, trainees and suppliers from the personnel records.
Answers for clients
The Executive report sums up the state of security in Italian or English: it is the document to attach when a client asks how you protect their data.
A firm that can demonstrate its own diligence
- You know whether the firm's email is configured securely, and when it gets worse you receive an email.
- You discover exposed credentials before someone else uses them.
- You have appointments, records and training ready in case of an inspection or a client's request.
- You can answer clients' questionnaires with documents, not reassurances.
When the platform detects a suspicious sign-in to Microsoft 365 it proposes blocking the account, but does not do it by itself: a person always decides. In a firm, locking a partner out halfway through a court filing costs as much as an attack.
If the firm has no in-house technician, the MDR + SOC level entrusts the handling of alerts to Dottor Marc's SOC, with ticket support during working hours. See the levels on the Product page.
Questions about cyber security for professional firms
How can I tell whether the firm's mailbox has been breached?
The typical signs are forwarding rules that no one created, messages missing from the inbox, sign-ins from unknown countries or devices and clients receiving emails you did not send. The Microsoft 365 tenant assessment checks for suspicious mail rules and the access register flags anomalous logins. If you find a rule you do not recognise, change the password and turn on two-step verification straight away.
What should we do if a client paid to a fake IBAN sent from our email?
The client must immediately ask their bank to recall the transfer and report it to the Polizia Postale, the Italian police unit for cybercrime. The firm must secure the mailbox, work out since when the attacker had access and assess whether it is a data breach to be notified to the Garante within 72 hours. Document every step: you will also need it in dealings with your insurer.
Does an accountancy firm have to comply with NIS2?
In general, no: accounting, legal and consulting services are not among the sectors listed in Legislative Decree 138/2024, the Italian law transposing NIS2. But the firm works for companies that may be, and they have to assess the security of their suppliers. That is why receiving a questionnaire is increasingly common: it is worth having the answers documented before it arrives.
Is two-factor authentication enough to protect Microsoft 365?
It is the single most effective measure against stolen passwords, but it must be turned on for everyone, administrators included, and must have no forgotten exceptions. Other points remain to be checked: the apps users have given access to their email, guest accounts, forwarding rules. That is what the periodic tenant assessment checks. Find out more in the entry on multi-factor authentication.
Where professional firms start
Microsoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn more SeeGoogle Workspace
35 checks from the CIS benchmark on your Google Workspace configuration, email included.
Learn more SeeDark Web Monitoring
Compromised company credentials and mentions of your brand on leak and ransomware sites.
Learn more SeeCyber Awareness
Simulated phishing campaigns prepared and run by Dottor Marc, with the results in the platform.
Learn more GovernGDPR forms
Appointments, privacy notices and authorisation letters for all your staff, generated in one step.
Learn more ProveReporting
Executive, technical and presentation reports with editable charts, generated automatically too.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.