TLOMA Today

We have had a great start to 2022 with a full slate of SIGs, in-person conference planning, and our upcoming golf tournament and Professional Development event. The combination of in-person and virtual events has allowed TLOMA to continue to provide you with significant support, focusing on education and development with opportunities to network with other professionals.

Each of our firms has managed its way through the pandemic in different ways while the support of the association has helped many of us make informed decisions for our “home teams.” I was speaking with a former member the other day who is coming back to the industry and plans on rejoining. She mentioned how much TLOMA meant to her while building her career and that it was one of the things she missed most during her time outside of legal. I encourage you to speak with colleagues who are not members and advocate the benefits TLOMA has to offer.

In May, our SIGs include:

• Human Resources – Responding to Bill 27 – “The Right to Disconnect” on May 12
• Technology – Improve Collaboration and Productivity in your Firm – Microsoft Teams Overview on May 17
  
  

If you haven’t already, I encourage you to register for our golf tournament at Royal Woodbine on June 22. It will be a great opportunity to mingle with members and business partners. Last year we had a great turnout and all levels of ability are welcome!

Conference planning is well underway as you will have seen with the announcements of both the keynote and closing speakers. We are back to White Oaks Resort this year and the committee has planned a number of really exciting events for us. Early-bird pricing is in effect until the end of the month.

Cyber warfare is real. Every law, justice and court organization is vulnerable for a cyber attack. The harsh reality is that lawyers are especially in danger because their biographical information is so easily accessible. These attacks come in many different forms – everything from stolen data held for ransom, to sensitive information being put at risk and opening the door to impeded workflow, liability, and loss of clients.

Legal organizations handle large amounts of highly sensitive personal identifiable information (PII), data, and money making them very appealing to malicious actors. Keeping client sensitive information safe should be one of the highest priorities of a law firm.

The American Bar Association and the U.S. Department of Justice report that 25% of all law firms have experienced some form of data breach. Consider that the New York entertainment and media law firm Grubman Shire Meiselas & Sacks was hacked and the ransom demand was $42 million. Many of the demands are smaller, but still costly and difficult from which to recover.

The Threat Actors at Work

Criminal enterprises, nation-states, inside attackers, hacktivists and other malcontents lurk in the cyber sea waiting to feed on unsuspecting victims. Legal organization leaders not only must worry about criminal enterprises and nation-states, but to a greater extent, must prepare for potential insider attacks or other lone wolf malcontents.

There are also other attack types including keyloggers (a software program or device designed to secretly monitor and log all keystrokes). They pose a serious threat to users, as they can be used to intercept passwords and other confidential information entered via the keyboard. As a result, cyber criminals can get PIN codes and account numbers for e-payment systems, passwords to online gaming accounts, email addresses, user names, email passwords, and almost any other information imaginable. 

Rootkits are a type of malware designed so that they can remain hidden on a computer. While they might not be noticed, they are active. Rootkits give cybercriminals the ability to remotely control a computer.

Cyber criminals also use back door attacks – accessing a system through unsecured points of entry.

These are commonly known as advanced persistent threats (APT). With nation-states, the objective with an APT is to remain undetected on the network, gather data and intelligence, learn what controls are on servers, get the network architecture, and then start searching for vulnerabilities they can use to either disrupt the organization, steal intellectual property or make money off of it by selling client data.

These are not “might happen” scenarios. The most common distribution methods, known as attack vectors, include email attachments, apps or Excel spreadsheets, Word documents, or other files that deliver a payload once the file attachment is opened on the computer. Ransomware can also be delivered by a drive-by hit on a compromised website. That is why websites must be secure. 

Even legitimate advertising networks – especially those that provide news and information and have ads - can be fooled into spreading malware. Malicious USB drives are a great delivery mechanism to attack a system. They are effective in gaining access to or compromising a network.

Users must practice good password hygiene and never reuse the same credentials on multiple websites. If a criminal gains access to an email account the next step is to use the credentials to get into bank accounts, other websites, and steal identities. Even with good security hygiene, hackers can use simple penetration testing tools to identify open ports on a network. When the tool finds an open port it lets the hacker looks for vulnerabilities, unpatched software, and other ways to exploit the service. Just like that, the hacker has access to data.

Take the Prevention Stance

To prevent this, an organization must secure its information. Imagine an onion - the core of the onion are the assets to protect such as servers. Assume that administrative, technical, and physical controls can break so the best defense is NOT an unhackable single layer. Multiple layers are the only way to target attack vectors. Dozens of layers could be added to a security posture to protect core assets and devices, data, and customer information. The key is to make certain any holes in the layers are not aligned to allow penetration. The security strategy must take into account the hazard, technology, process and people to prevent loss. 

Even so, there are vulnerabilities – mostly human error – which makes constant security awareness training crucial.

Hacking Has Come a Long Way: The Email Attack Vector

Hackers are professionals. Long gone are the days of broken English and misspelled words. Especially in the case of spear phishing attacks, the techniques are very refined. The criminals learn about an organization and then use tactics such as sending an email that looks legitimate. For example, an email from an executive authorizing a $50,000 wire transfer. Layered security is the defense.

Choose tools to authenticate the mail server and to prove to ISPs, mail services and other receiving mail servers that senders are truly authorized to send email.

Again, it cannot be stressed enough that organization leaders must create and foster a security-first environment. Everyone who has access to any kind of computer or device on a network must have security awareness training. Continuously. No one is exempt.

Understanding the Tools and Building a Security Toolbox that Works

A best practice is to employ a cybersecurity expert who has email and domain access within the organization. Understand that a security expert and IT professional are not the same. They complement each other.

The job of a spam filter is to trap emails with potentially malicious attachments. It is a first line of defense in a ransomware attack. Once criminals have open access to a network, they can access an encryption key. Then file encryption on the target begins, and tests run to make sure the files can be unencrypted once the victim pays the ransom. Ironically, distributors of malware have good customer service. Some actually have 800 numbers and use screen sharing support to help make sure the victim’s files get unencrypted, and offer assistance with ransom payment using Bitcoin, View Cash, or other methods. 

In addition to a spam filter, a known DNS filter will trap the request and the files will never get encrypted because no key was shared. Tools such as Windows Defender will defend against Trojans, but for malware attacks that is not enough. Endpoint detection and response (EDR) is necessary. If all other physical controls fail, the savior is EDR which uses behavioral analytics and artificial intelligence to see if the commands are normal and behaving as expected. This is a different way to look at security. In the past users were assumed to understand threats such as phishing attacks and be diligent about handling email attachments. Macros were assumed not to be malicious. That is not true today.

Orchestrating Prevention and Solutions

The complexity of these attacks builds the case for security designed to allow time to orchestrate mitigation.

All of the tools available are useless without orchestration – properly assessing the risk, having the technical tools ready, plus understanding administrative, technical, and physical controls. The best case scenario is a security provider with multiple vendors and best-of-breed products, practices, and policies.

In the final analysis, whether a law, justice or court organization decides to handle security in-house or outsource it, the key to success is having both a management and policy-driven remote access strategy with the ability to monitor the hardware devices on a network and analyze the logs to see if they are showing any abnormal behavior.

I met a new law firm who asked me to go to market for their employee benefits.   I told them no.  They looked at me with astonishment.  “Why not”, they said. 

In our conversation, it came to light that they had asked quite a few ‘brokers’ to go to market for them.  All at the same time.   When a well-intentioned firm does this, it creates unintended consequences including chaos and a dysfunctional marketplace.

The rules of engagement in employee benefits in Canada are straightforward, but not well understood by many employers.   Most insurers will release a quote to a consultant if they produce a set of ‘employer specs’.  These specs usually include your most recent renewal, your current rates, your premium vs. claims history and an employee data listing. 

The problem starts when multiple consultants go to the same markets at the same time for the same employer.  Each insurer will only release one quote.  So whichever consultant gets to the insurer first – gets the quote from that insurer;  Unless a different consultant produces an ‘Agent of Record’ (AOR) letter in the employers’ name.  In that case – the quote that was originally sent out is now given to the consultant with the AOR.  But it’s the same quote.

So if there are say, 10 insurers, only 10 quotes can be received by the employer.   If you add a few consultants to the circus, one consultant might get you 3 quotes, another might get 5 quotes and the last broker gets 2 quotes.  But they are the same 10 quotes that you might have received from one consultant, if you only went to market with one consultant.

Knowing this, you can see why going to market is the LAST thing you should do.   Best practice is to choose your consultant first – and let them survey the market on your behalf, after deep consultation on your needs.

Even better, you should delay going to market – until you know why you’re doing it. 

If it’s to save money – you might be better off looking at your alternatives first.    Maybe the problem is not your plan or your rates, it might be your consultant.

In today’s marketplace having good representation from a professional consultant is more important than ever.   Getting good advice can help your firm not waste premium dollars, streamline administration, lower costs through wellness, reduce fees, reduce risk and obtain better reporting to name a few.

Best practice is to go to market on your consultant first – and decide who is the best fit for you and your firm.  Then you can work on identifying and controlling costs for the long term through many best practices.

Interviewing Consultants

It’s time to change consultants – what should I do?

At some point – you may find that your firm has outgrown your current employee benefits broker/consultant.  Signs and symptoms include;

• The consultant is reactive not proactive
• You are bringing your broker ideas (not the other way around)
• Your broker is not an employee benefits expert
• Your broker does not specialize in serving the legal community
• Your broker is a long time friend of the owner/managing partner
• Your broker has not kept up with current market trends and ideas
• They are unresponsive, elusive and slow to respond

Our best advice is to interview 2 or 3 new consultants to determine your next move. Then, appoint your chosen consultant as your ‘agent of record’ going forward.

Here is a good list of interview questions;

 1.  Can you provide me with short list of observations and recommendations having reviewed my most recent renewal?
 2.  What percentage of your client base is fully insured? ASO?
 3.  Which insurers do you work with? Do you concentrate and/or partner with any insurer in particular?
 4.  What experience do you have in our industry?
 5.  How would you get paid on my group? What are your fees?
 6.  What size market (employee count) do you mainly serve?
 7.  In which provinces are you licensed?
 8.  Can you serve us in both official languages?
 9.  Do you have a service level agreement? How often will we meet?
10.  How often do you provide us with reporting? Monthly/quarterly/annually? Please provide sample reporting.
11.  Do you see any advantages or disadvantages of dealing with a TPA? Which TPA’s do you recommend?
12.  Explain how stop loss insurance works for both insured and ASO plans.
13.  How often would you recommend going to market?
14.  Describe your Service Team.

Want to add People Corporation to your shortlist?  Get in touch at tloma@peoplecorporation.com

As everyone can clearly see, we’re now at a crossroads where most law firms are in transition to a new working model. The pendulum, that swung so rapidly towards full time working from home at the beginning of the pandemic, and then swung back to the office when conditions allowed, has now just about settled on a blend of the two.

Consequently, the new workplace that’s being defined right now for most firms is a hybrid model. It involves physically reconfiguring the traditional office into a much more social space for congregation and interaction. Meanwhile staff will work from home, or anywhere else, two or three days a week on average, depending on personal circumstances and operational demands.

It follows that there’s a near-universal acceptance among law firms that, if they don’t already have it, they now need new technology to support this model. Moreover, they recognize it needs to be Cloud-based, which offers the flexibility in access from any location, as well as the potential for superior security. It enables the hybrid working model and if done right future-proofs the firm’s investment in technology.

But what many firms are much less right about at the moment is their selection process for this new technology. Often at times– and dangerously – it has not kept pace with the implications of moving to a Software as a Service offering.

THE PROBLEM WITH PRECEDENT

The problem is that firms are still choosing software in the way they’ve always chosen software, where precedent and the past are highly weighted in their decision. It leans on factors such as how many years of trading the vendor has under its belt and how many clients are using their software, irrespective of the versions (i.e. blue chip established brands). This has always seemed like a prudent way to proceed. But unfortunately it’s a methodology that breaks down in the face of present reality.

The new reality is that vendors with thousands of clients that they’ve kept happy for many years are potentially dragging a technological debt behind them that will increasingly impede their forward progress, especially in disruptive times where both the technology platform and the workplace are changing.

There’s a danger that the time and attention these vendors devote to maintaining and supporting their legacy systems and servicing their large client base can mean they don’t have the bandwidth and focus to re-invent themselves as a dominant player into the future. Paradoxically, a stellar past performance can act as a kind of “anchor” on forward momentum. Or simply put, each $1 of investment in R&D is diluted by its partial allocation  to the past. Conversely, a Cloud-first provider is 100 per cent invested in a single platform built for the future with its client base (although smaller) strategically aligned. It’s essentially anchorless and ripe for innovation at pace!

What law firms should do is recognize that a great disruption and dislocation has taken place and that as a result, when it comes to technology, past performance is no longer a reliable indicator of future returns. When it comes to selecting software partners, there are now new questions to ask and new factors to evaluate.

RETUNING TECHNOLOGY SELECTION

Ensuring that the software does what you need it to do is a given. But in addition, firms should scrutinize the technology. Is the software “Cloud-first” – in other words, built from the ground up as a Cloud-based application, as opposed to being something that’s been adapted for or migrated to the Cloud, but originated as an on-premise solution. The trouble is that older software that is only retrospectively adapted for Cloud use is prone to more glitches, performance compromises, and an inherent inability to scale.  A tell-tale sign is software that’s migrated to a private Cloud or is not multi-tenanted usually indicates the presence of a mixed technology stack with the past and the present trying to co-exist, albeit often with friction.

Another serious compromise that firms need to look out for in older software is that it may not be “extensible”, which is to say it can’t easily integrate and connect with other modern “Cloud-first” applications. Going forward this could be a big problem when you want to integrate say your time capture solution with a new billing system. Lack of integration or extensibility means a solution that’s not future proofed, which should be an immediate disqualification.

SECURITY CONSIDERATIONS

Firms also need to look beyond the software at the vendor itself. In place of a long track record, you’ll want to determine if they’re well-funded and trustworthy. This latter is essential. Before Cloud, the vendor sold you a solution that you were the custodian of. It was a much simpler transaction.

In the Cloud world, that vendor is the on-going keeper both of the software, but also of your data – a much more intimate relationship to say the least. It becomes critical to establish that they’re reliable and trustworthy, and that you’ll be happy to work with them mid to long term. They’ll need to convince you of this by explaining their information governance processes and procedures, and how they’re audited both internally and externally. You’ll need to see independent third-party accreditations that verify the quality of their information management system including qualifications like ISO 27001 certification and/or SOC2 reports derived from independent information security audits.

In addition, you’re no longer intrinsically interested in how many total customers the vendor has, but rather in how recently and how quickly they were acquired. One thousand clients on a legacy on-premise system is worth less than a handful of clients on a functional, Cloud-first solution supported by evidence of trust and credibility along with a compelling roadmap that’s properly funded.

FIERCELY COMPETITIVE

Firms often used to begin the search for new software by speaking to friends and peers. “Ask Bill what they’re using,” was often the first step. In today’s more fiercely competitive legal environment, that approach is less viable, so firms need to make independent well researched decisions.

To do so, keep in mind that you’re investing in the future and not the past. No one has a working crystal ball, but remember that a large client base using non-Cloud-first software is a big potential red flag, even though the harm to ROI may not manifest itself for two or three years.

So, forget precedent. For software that will deliver the maximum ROI, you want to identify agile, dynamic and responsible vendors offering secure, extensible, Cloud-first solutions and the prospect of ongoing innovation; not re-engineered solutions from known brands. In short, the world has changed. The way you choose software must change too.

Join the Advanced and NetDocuments virtual event available on-demand, where we discuss how to effectively address the changing work environment, the evolution of Cloud technology, defending against the growing presence of cyberthreats, the changing law firm-client relationship and more by clicking here.

There’s a peculiar notion within traditional law firms that when you become an equity partner, a switch is flipped from doing the work to getting the work. But if this transition was as dramatic as it sounds, you wouldn’t survive long enough to partake in the partnership draw.

This is why developing a sales mentality that evolves into a value culture is a long-term undertaking.

Sales methodology involves hardcore factors such as data mining, information sorting, and market targeting balanced by soft skills that include active listening, thoughtful communication, and client care. This process must be supported by repetition, perseverance, and patience. A sense of humour and the ridiculous helps, too.

Selling legal services is not a job for the faint of heart and often not the best job for a lawyer. That said, for partners who are not naturally adept at sales, gleaning more files from current clients and securing work from new clients is best taken in small steps.

A Big Four Sales Culture

Years ago I managed EY’s Entrepreneur of the Year program in Canada, which was known as the firm’s number one sales driver. The program was created when EY adopted a sales culture in the mid-1990s.

This was when the accountants and consultants who, like lawyers, did not go to school to learn to sell their services, embraced a sales culture that is clients-first and industry-focused. Led by sales professionals, it is supported by sophisticated teams, tools and systems.

Partners who were active during the sales culture’s early years credit it with saving the firm and making them more money than they ever imagined. After 30 years, the sales culture has morphed into a value culture.

This enables partners to focus on high-value matters and current clients as well as engage with qualified new ones – all of whom are nurtured throughout the sales process – while shuttling commodity work to internal service teams. It also affords investment in EY’s people and infrastructure, which results in solid returns.

Stop Hunting

While lawyers don’t usually snag clients with butterfly nets or by grabbing jacket lapels, I’ve overhead cringe-worthy questions from the former to the latter, such as “Who does your legal work?” or the more direct “How do we get your legal work?” as an opening salvo to a dead-end conversation.

With no graceful recovery from such an awkward opener, the now not-in-this-lifetime client dashes away wishing their wingtips could help them run faster.

The term “getting clients” is overly aggressive, even though it has been used in the legal market forever. Perhaps, for those inclined to over-compensate for reasons of shyness, insecurity or the like, it may instill authority. For clients, it implies being hunted.

This is why such clients may bridle against classic “hunting” methods, such as golf dates, hockey tickets, or even being taken to lunch.

“Getting clients” fails because nobody wants to be got.

Be a Farmer

Farmers are methodical, diligent, resourceful, and patient. They don’t salivate at the thrill of the chase, but instead are sensitive to developments and changes in market conditions, and adjust their actions and timing to deliver as expected.

Just as a farmer does, successful selling means seeding and weeding your target market, and developing business among contacts who respond to attention.

This is the core of legal market strategy. Next steps include marketing, which entails executing on key tactics that underpin market strategy.

Business development happens when marketing activities enable two-way connections with those who may need your assistance now or in future. And client retention embodies the nurturing of a relationship that, over time, grows to where trust earned continuously enables a strong bond.

Maturing to Value

Rainmakers are fallacies. “Rainmaker” implies a mystic aura around someone who creates wealth through their seemingly magical ability to connect with others. Rainmakers do not exist anymore than do tooth fairies.

Instead, there are people who, by nature or study, have an ability to frame their uniqueness as value. They are often observant and contemplative. They listen more than they speak. When they speak, they say little but their words matter.

Their confidence comes from a sense of self that is rooted in a maturity that has nothing to do with age. Instead, it stems from a concentration on and consideration of how they or others can improve another person’s situation.

This is when sales crystalizes into value. And when that happens, it’s magic.

This article first appeared in Canadian Lawyer, March 2022.

The impacts of the Ukraine-Russia conflict reverberate beyond the global political and economic landscape and could hit closer to home than you realize.