Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
All industries // LEGAL FIRMS

Privilege is a promise you make with your infrastructure

Managed security and IT for Australian law firms, from a team that understands what a partner has to be able to say after a laptop goes missing.

Talk to us about your practice
 Free, no access needed See what you are exposing
// WHAT YOU ARE ACTUALLY UP AGAINST

The obligations and pressures, in plain English

The specific pressures on legal firms in Australia, with the regulator or source named. Where a duty comes from a contract or an insurer rather than a statute, it says so.

01

Confidentiality is a professional obligation, not just a courtroom concept

Practitioners owe clients confidentiality, and privilege can be argued over when confidential material has not been kept confidential. No statute tells a firm which technical controls to run. What a firm needs to be able to show is that it took reasonable steps, and privileged material on an unencrypted laptop, in an unmonitored mailbox or in a file share nobody has reviewed is hard to describe that way.

02

The Notifiable Data Breaches scheme may apply directly

Firms with annual turnover above three million dollars are generally covered by the Privacy Act, and with it the Notifiable Data Breaches scheme. Smaller firms are often outside the statute, but client agreements, panel terms and insurance policies frequently impose breach notice and security obligations of their own. Those are contractual duties rather than statutory ones, and they can be just as binding. The OAIC sets out who the scheme covers.

The OAIC on the Notifiable Data Breaches scheme

03

Trust accounts attract a specific kind of attacker

Business email compromise targeting settlement funds is one of the most common and most expensive attacks on Australian legal practices. It is not a technical exploit. It is an email that arrives at the right moment with changed bank details.

04

Clients, insurers and law societies all ask

Corporate and government clients send security questionnaires before they brief you, and professional indemnity and cyber insurers ask about controls at renewal. State law societies publish cyber security guidance for practitioners. None of that is legislation, but a panel position or a policy can depend on the answers, which makes security a business development question as well as a cost.

// WHAT ACTUALLY GOES WRONG

Four patterns we keep seeing

A device leaves the building

Laptops go missing from cars, cafes and airports. The useful question is whether you can show the same day that it was encrypted, locked out and not used to reach anything.

The settlement email

A compromised mailbox watching a conveyancing matter, waiting for the moment to send amended account details. Multi-factor authentication and mailbox rule monitoring make it much harder, and confirming changed bank details by phone catches much of what gets through.

Everyone can see everything

Small firms grow into their file structure rather than designing it. Years later every staff member can open every matter, including the ones involving their own colleagues.

The practice management system nobody patches

Legal software is often old, often on-premise, and often the one thing nobody will touch in case it breaks. That is precisely why it needs a plan rather than avoidance.

// FROM THE FIELD

The stolen laptop that stopped being a problem in nineteen minutes

A partner's laptop taken from a car on a Friday afternoon. The call came in at 4:41pm. By 5:00pm sessions were revoked, a wipe had been issued and disk encryption was confirmed. With a clean sign-in log, that supported a reasonable conclusion that nothing had been accessed, written up as an assessment rather than a guarantee.

Read the write-up
// WHERE TO START

What matters most for legal firms, in order

01

Managed Security

24/7 monitoring of the mailboxes and devices where privileged material actually lives, with a responder who owns a confirmed incident end to end.

 02

Security Baseline Assessment

A fixed-price read-only look at your Microsoft 365 and Entra environment, which shows who can actually reach what.

 03

Cybersecurity Governance and Compliance

The policies, the tested incident response plan and the evidence register that turn a client security questionnaire from a fortnight into an afternoon.

 04

Security Assessments and Penetration Testing

Penetration testing and access audits, for firms that need to prove the controls work rather than assert it.
// ASKED BY LEGAL CLIENTS

Frequently asked questions

No. The test under the Notifiable Data Breaches scheme is whether the breach is likely to result in serious harm, and remedial action taken quickly enough can mean there is no eligible breach to report at all. Speed matters, and so does evidence. A remote wipe command and no new cloud sign-ins indicate the device has not been used to reach your mailboxes or files online. They do not on their own show that files stored on the laptop were unreadable, so the assessment also confirms the disk was encrypted, that the firm held the recovery key, and whether the wipe was ever received.

When a breach must be reported

It covers their platform, not your firm. Your mailboxes, devices, identities and file shares are yours, and they are where many incidents start. Ask your vendor in writing what they are responsible for.

Attacks on legal practices are rarely targeted at a named firm. They are opportunistic and automated, and they find whoever has the weakest controls. A four-partner practice holding conveyancing funds with fewer controls can be an easier target than a large firm with a security team.

By having the evidence already assembled rather than assembling it under deadline. That is the whole point of an evidence register, and it is the single most useful thing a firm on a panel can build.

The Essential Eight evidence checklist

Working nationally from Melbourne, Victoria. How the national service works, or see the other sectors we write about.

Tell us what you are protecting.

Get in touch