Tiplet: Antivirus Software and Assistive Technology

If you use assistive technology, such as a screen reader for the visually impaired, and you are shopping for anti-virus software, here are some resources you might consider:

A blog follower also suggested Comparitech. If you know someone who can benefit from these resources, please pass them on.

Practical Advice for Virtual Law Offices

Last week we discussed the ethical implications of WSBA Advisory Opinion 201601, “Ethical Practices of the Virtual Law Office.”  As the Committee on Professional Ethics noted, virtual practitioners must take care with supervision, confidentiality, avoiding misrepresentation, and conflicts of interest.  Understandable, but what exactly does that mean?  Here is some practical advice.

online-1799664__480

Adequate supervision in a virtual workplace

In a virtual workplace lawyers and staff don’t work in proximity.  How do you ensure that remote workers receive “adequate supervision?”  The WSBA opinion mentions taking “additional measures,” but does not describe what those may be. Virtual employers should consider the following:

  1. Establish policies just as you would in a traditional office setting:  dedicated working hours when employees are expected to be within reach of their phones or computers; vacation allowance; sick leave policy; how you will measure performance; and so on.
  2. Create procedures for employees to follow.  Specifically, how will you distribute assignments and exchange completed work?  Technology is bound to be the solution, so see the discussion below about confidentiality.  Remember to address the “mundane” office tasks too: calendaring, accounting, conflict checking, etc.
  3. Require all remote workers to sign a confidentiality pledge or agreement.  The Professional Liability Fund has samples on its website.
  4. Get fully educated about legalities:  “In 2011, an Oregon appeals court found in favor of a J.C. Penney Co. Inc. home decorator who was injured after she tripped over her dog while working at home. Although the state workers’ compensation board had held her injuries were not work-related, the appeals court reversed, finding the employee had been working from her home as a term and condition of employment.”
    On-the-job injuries aren’t the only problem: be aware of Fair Labor Standards Act troubles, choice of jurisdiction, protecting proprietary information [forms bank, brief bank, customized practice management software], and the Americans with Disabilities Act.  The list doesn’t end there.
  5. Talk to an employment lawyer about securing your right to inspect employees’ remote workplaces and monitoring employees’ use of technology.
  6. Don’t neglect the need for face time. Management experts recommend regular web meetings and occasional in-person meetings for an optimal virtual workplace.
  7. Revisit your ethical responsibilities as a supervisor in Oregon.

Confidentiality

Advisory Opinion 201601 revisits the ethical requirements for cloud computing and email communication, the gist of which is:

  • A lawyer may use online data storage systems to store and back up client confidential information as long as the lawyer takes reasonable care to ensure that the information will remain confidential and the information is secure from risk of loss.
  • Email communication with clients is allowed, except lawyers must warn clients if they believe there is a significant risk of third party access.

Oregon takes a similar stance on cloud computing:  “Lawyer may store client materials on a third-party server as long as Lawyer complies with the duties of competence and confidentiality to reasonably keep the client’s information secure within a given situation.” OSB Formal Opinion No. 2011-188 [Revised 2015.]  For more details, see this post.  See Also OSB Formal Opinion No. 2016-191, “Client Property: Electronic-Only or “Paperless” Client Documents and Files,” which includes a further discussion about electronic client files.

As to email, Oregon lawyers are forewarned to:

  1. Use proper security measures in cases where information is “particularly sensitive or subject to a confidentiality agreement.”
  2. Avoid email entirely if a client requests it.
  3. Scrub for metadata.

See “Safeguarding Client Information in a Digital World,” and “Competency: Disclosure of Metadata,” OSB Formal Opinion No. 2011-187 [Revised 2015].

No mention is made about a duty to warn clients of third party access where the lawyer believes there is a significant risk.  However, it would be foolish not to do so.  Consider the example mentioned in the WSBA opinion: where the lawyer knows her client is using an employer-provided email account.

We’ve discussed this issue before. Your email may not be protected by lawyer-client privilege if your client is reading it at work.  Before you begin communicating by email, take note of the client’s address.  Does the domain correlate to their place of employment?  Don’t use it!  Even if the address is @gmail.com or a similar web-based service, don’t assume your client only reads and prints email at home.  Have a discussion about where, when, and how your client reads your confidential communications and follow the other advice mentioned here.

Another quick word about using the cloud

Virtual practices could not exist without the cloud, a VPN, or some means of hosting and exchanging client information.  Beyond the basics of taking reasonable care to protect confidentiality, implement policies and procedures as described above.  Focus on security and steps to take when a virtual employee stops working for you.  Remote workers can put your law practice at risk if they upload or exchange content that contains malware or ransomware. A study commissioned by a security firm in the UK and Germany found:

  • One in four employees admitted breaking security policies.
  • Nearly two in five said either they, or someone they know, have lost or had stolen a device in a public place.
  • Three-quarters of these devices – such as laptops, mobile phones and USB sticks – contained work-related data, including confidential emails (37%), confidential files (34%) and customer data (21%).
  • Approximately one in ten lost financial data or access details such as login and password information, exposing even more confidential information to the risk of breach.

It is equally important to have a checklist for departing staff that ensures revocation of login credentials, return of workplace property, and disposition of ongoing email or voice communications directed to someone who no longer works for you.

Consider talking to an employment law attorney, or as a starter, see the Professional Liability Fund’s (PLF’s) Checklist for Departing Staff.

Duty to avoid misrepresentation

Advisory Opinion 201601 warns that lawyers may not imply the existence of a physical office or formal law firm where none exists. Therefore, unless you’ve arranged for ready access to meeting spaces or the ability to see clients on a drop-in basis, don’t imply those resources exist.  Posting or implying that you are part of a firm on your website, social media, or elsewhere is also a no-no.  (The same is true for office sharers, an example given in the ethics opinion.)

Avoiding conflicts of interest

Advisory Opinion 201601 points out that virtual offices must ensure that the conflicts checking system is equally accessible to all members of the practice, lawyers and staff, and that such access is reliably maintained.  This only makes sense.

Be sure to add your calendaring system, billing system, client matter records, and everything else you need to operate virtually as a law practice.  All of it must be equally accessible and reliably maintained.

Will the cloud be your savior when it comes to accessibility and reliability?  Probably, but it can’t help you with issues like when to run a conflict check, how to run a conflict check, or the need to circulate a new client list to everyone in the office.  As noted above, procedures will be key!  For help, contact a friendly practice management expert, like myself or one of the advisors at the PLF. While you’re on the PLF site, check out the many publications, practice aids, and forms that will assist you with establishing office protocols.

All Rights Reserved Beverly Michaelis 2017

MS Ignite 2016: New Ideas, New Features for OneDrive, Office 365, and More

September 26-30 marked Microsoft’s second annual technology conference known as #MSIgnite. With over 22,000 attendees, the conference set Twitter afire with a long list of product enhancements – some available now, others coming before year-end.

New Functionality for OneDrive Users

If you’re a OneDrive user, you’ll be thrilled to hear about these new features:

  • Ability to sync SharePoint Online document libraries and OneDrive folders
  • One-stop shopping for browsing and editing SharePoint Online and OneDrive files using the OneDrive browser client
  • Ability to download multiple documents as a .zip file
  • Improvements to the Android OneDrive App – support for SharePoint Online files and multi-page scan enhancements
  • Notifications to your mobile device when someone shares a OneDrive file with you
  • Ability to see over time how many people have discovered and viewed your files in OneDrive for iOS

See the full list of OneDrive updates here.

Enhancements to the Outlook Mobile App

  • The new, improved calendar app on iOS and Android devices now offers event icons, simpler scheduling, and on-the-fly editing of recurring meetings
  • Use the “smart location” feature on the mobile app to easily add maps and directions to event details.  Next time you create an event, just start typing a location.  Choose one of the suggestions and Outlook will include a map with your event details.
  • Use the @ symbol to get someone’s attention: typing the @ symbol followed by a person’s name in the body of an email message or a meeting invite will automatically add the person to the To line of the email or meeting invite.
  • Coming soon: meeting invites will support real-time availability checks with a slide-bar interface – via @thevarnish
  • Outlook for iOS and Android is now powered by the Microsoft Cloud for Office 365. All your data is now fully delivered through Microsoft’s secure servers (no third party vendor, no mailbox data cached outside Office 365).
  • New assistive technology has been added for reading email, scheduling meetings, and adding a signature

Improvements to Word, Excel, and PowerPoint

Word

  • Use Researcher to find credible sources and content: “Researcher is a new service in Word that helps you find and incorporate reliable sources and content for your paper in fewer steps. Right within your Word document you can explore material related to your topic and add it—and its properly-formatted citation—in one click. Researcher uses the Bing Knowledge Graph to pull in the appropriate content from the web and provide structured, safe and credible information.”
  • Improve your writing with the new digital writing assistant known as Editor, a cloud-based service that uses machine learning, natural language processing, and input from linguists to improve writing through advanced proofing and editing. [Caveat: not suitable for confidential content.]
  • Write or draw with your finger, a pen, or a stylus in Word, Excel, and PowerPoint mobile apps (known as “inking.”)

Excel

PowerPoint

  • Use Designer to instantly turn a bulleted process list into a SmartArt graphic
  • Get an “instant slide makeover” any time by selecting the “Design” tab in the ribbon.  Choose “Design Ideas” (far right of the Design toolbar) to preview new slide designs.
  • Use the Recording tab to create a presentation that includes recorded slides, screen recordings, narrations, and videos. Embed quizzes and other apps in your presentation to make it more interactive for your audience.
  • Use QuickStarter to find outlines for any topic, including recommendations on information to include, categories to consider and associated images tagged with Creative Commons licenses.

Making Skype Better

Skype for Business is already the number one meeting app, so how can it get any better? Consider these improvements announced at #MSIgnite 2016:

  • Skype for Business for Mac will be available in October, with hi-def audio and video, one-click join for meetings, and video and desktop sharing
  • Also coming in October: enhancements to the iPhone app: Skype for Business calls will work just like a cellular call on your iPhone. You can accept a call via the lock screen or put a Skype for Business call on hold to take a cellular phone call—it works just like a phone.
  • Real-time transcription and translation in 50 languages will come to Skype Meeting Broadcast by year-end

Migrating to Windows 10

If you haven’t migrated to Windows 10, check out this free migration assessment tool from VMWare.  Announced at #MSIgnite, the new tool is designed to assess:

  • Windows 10 readiness;
  • End-user behavior;
  • Device inventory and configurations;
  • Software dependency and usage information; and
  • Web and network usage patterns.

If this sounds like tech-speak, it is.  But the goals are simple: (1) identify potential problems transitioning from your current operating system to Windows 10; (2) Optimize your use of Windows 10.

Still not sure?  Contact your computer consultant.

Key Microsoft Security Improvements

There are two kinds of big companies: those who have been hacked
and those who don’t know they’ve been hacked. 

@JPvR_NL

Protecting Browser Sessions

Most cyber attacks start at the browser level, making browser security critically important. Windows Defender App Guard for Microsoft Edge protects against browser-based security incursions:

Unlike other browsers that use software-based sandboxes, which still provide a pathway for malware and vulnerability exploits, Microsoft Edge’s use of Application Guard isolates the browser and employee activity using a hardware-based container to prevent malicious code from impacting the device and moving across the enterprise network.

Once enabled, enterprise administrators can configure a trusted network site list policy and distribute the group policy to any devices it wishes to protect with Application Guard. Even if an untrusted site successfully loads malware, the malware is unable to reach beyond the isolated container to steal data or permanently compromise devices or the network. Once the employee exits their Microsoft Edge browsing session, any malware is erased, preventing further attacks.

Detecting and Responding to Cyber Attacks

Security features and cyber threat intelligence gathered from WDATP (Windows Defender Advanced Threat Protection) and Office 365 ATP (Advanced Threat Protection) are now combined to allow enterprises to detect, investigate, and respond to advanced attacks on their networks, Windows 10, and Office 365.

Now, IT can identify and follow the complete chain of an attack from an email – to across the network – with detailed timelines and analysis. This real-time access and product integration converts the time to investigate an incident from days or weeks to mere hours. And the comprehensive security intelligence from Microsoft and our industry partners, including FireEye iSight threat intelligence, puts all the information needed to investigate and respond in an easy, simplified interface with clear steps for remediation. It’s the most comprehensive and robust security solution available today.

Interesting Stats from the Keynotes and Other Presentations

  • There are 70 million Office 365 users and over 400 million Windows 10 users
  • The Department of Defense is targeting to have Windows 10 on more than 4 million devices
  • Office 365 has an uptime of 99.98%
  • The average person uses 3 mobile devices at work (expected to increase)
  • Skype for Business is the most-used meeting app: Microsoft manages over 13,000 meeting rooms; 38% of all international calling uses Skype; the Skype app has been downloaded 1.1 billion times on iOS and Android devices
  • 58% of workers admit to sending data to the wrong person
  • Microsoft scans 200 billion emails every month for malware
  • 50% of cloud-era millennials will be in the workforce by 2020

Other News from #MSIgnite

  • You may have heard of Azure – Microsoft’s integrated cloud service platform. #MSIgnite 2016 included a number of Azure upgrades of interest to developers and IT professionals.  Read more here.
  • Many SharePoint improvements were announced at #MSIgnite 2016.  For all the details, check out this post.  Also see this summary from Microsoft.
  • Over 150 on-demand video sessions are available at no charge from the 5 day conference. Check out the list here.

All Rights Reserved 2016 Beverly Michaelis

7 Steps You Can Take Now to Protect Your Data

lockUnless you’ve been playing ostrich, you’re likely aware that data breaches and ransomware are about as common as Mom and apple pie.  Witness the recent hack of 272 million Gmail, Microsoft, and Yahoo! accounts.

Fortunately, there are simple steps you can take now that will help protect your data.  [With thanks and all due credit to Lane Powell’s Beyond IP Law post, The Scariest Hack So Far, for inspiring this elucidation of their original list]:

Step 1: Start Using Encryption

For your desktop, cloud-based accounts, mobile devices – anywhere or any place you store or transmit confidential or private information.  For a thorough discussion of how to implement encryption throughout your firm, see Encryption Made Simple for Lawyers, now a book available for purchase on the ABA website.  (Non-ABA members in Oregon can save money at checkout by using the OSB Professional Liability Fund discount code: OSBPLF.)

Step 2: Set Up Two-Factor Authentication for Cloud Services

“The concept of two-factor authentication is that a person cannot access another user’s account without something she knows and something she has. In the case of popular services (like Google or Dropbox), the solution is a strong password plus a secondary code that is sent via text to a smartphone or mobile device.”  Catherine Sanders Reach, Set Up Two-Factor Authentication: What Are You Waiting For?  [Read Catherine’s post for step-by-step directions or search Help in your cloud-based service for assistance in setting up two-factor authentication.]

Step 3:  Erect Firewalls

Firewalls sit between you and the rest of the Internet.  They protect unauthorized access to your computer by ignoring or repelling information that appears to come from unsecured, unknown, or suspicious locations.  The best firewall configuration is a one-two punch:  hardware firewall + software firewall.

Setting up a hardware firewall requires no effort on your part.  While you can buy a stand-alone appliance, hardware firewalls are now automatically incorporated into your router (the box in your office or house installed by your Internet Service Provider).

Software firewalls are installed on your computer system like any other application, and are also easy/breezy since they are typically built into anti-virus software.  (See discussion that follows.)

Step 4: Install Anti-Virus, Anti-Malware, Anti-Spyware Programs and Keep Them Updated

This seems pretty explanatory, but let me add some free advice:

  • Don’t disable automatic updates to your virus definition database
  • Run quick scans when prompted
  • Run full scans at least monthly
  • Don’t ignore notifications that your software isn’t running properly

For a list of the best anti-virus utilities for PCs, see this list from PC Magazine.  For a list of the best anti-virus utilities for Macs, check out this MacWorld post.  For other recommendations, run a Google search.

My personal opinion: run far, far away from McAfee.  [I really don’t give a rip that it is “now part of Intel Security.”]  First, McAfee blocked access to my work VPN (virtual private network).  There was no way to set a rule or create an exception and tech support was incredibly unhelpful.  Second, McAfee is notoriously hard to uninstall. Using Add/Remove Programs in the Control Panel is only the first step; you must download a separate application from McAfee to get rid of it.  I mention this because McAfee tends to come pre-installed on laptops or desktops purchased from retailers like Best Buy.  What to do?  If McAfee was inflicted on you (pre-installed), get rid of it.  Follow the link above for the uninstaller.  Next, buy Kaspersky.  I have been very pleased with Kaspersky from day one and it has never interfered with my VPN connection.

Step 5:  Run Operating System and Other Software Updates

This also seems self-explanatory.  Mac and Windows OS ship with automatic updates enabled – don’t fuss with this.  If Microsoft or Apple thinks you need a security patch, a fix, or upgrade, let it run.  The same goes for every application installed on your computer:  Microsoft Office, Acrobat DC, Quicken, QuickBooks – let automatic updates run.  If you’re not sure whether automatic updates are enabled, check Help or search the product’s website.  Some programs also allow you to manually search for updates. Acrobat DC is an example.  In the menu, select Help, and choose “Check for Updates…”

Step 6:  Be Ready to Kill Your System If You Suspect a Breach

In the original post which inspired me to write on this topic, author Jane E. Brown comments: “Consider using a “kill switch”— when suspicious events happen, the IT department should automatically be notified and the network should shut down if no protective measures are taken.”

I have known of events that required a kill switch.  One Oregon lawyer was hacked via a phishing email.  The hacker was able to get enough information from the lawyer and the lawyer’s system to contact clients by email and request that they input credit card information to pay their bills. Fortunately, a few clients recognized that this request was outside the lawyer’s usual billing process and called the office.  The lawyer had to pull the kill switch and take other steps, including freezing bank accounts.  This turned out to be a smart move, as within 24 hours the hacker also attempted to withdraw thousands of dollars from the lawyer’s trust account.

Step 7:  Lose Your Device?  Lose Your Credentials.

There are some obvious times when it makes sense to reset or revoke user names and passwords (login credentials):

  • At termination
  • If a network-connected device is lost
  • You experience a security intrusion
  • Your security, privacy, or confidential policies are breached

Final Thoughtsth

None of these steps are difficult, but bouncing back from a security breach is.

 

 

[All Rights Reserved 2016 Beverly Michaelis]