Zero-Trust Security That Protected a 4-Office Law Firm

The Company

Blackwood & Reyes LLP is a litigation firm of 240 attorneys operating from offices in four cities. The firm's work product is confidential by definition: case strategy documents, settlement positions, deposition materials and client communications that opposing counsel would pay a great deal to see. Its document management system is the true vault of the business, and its network connects four offices, hundreds of attorneys and staff, expert consultants, co-counsel and court reporting vendors into a single working fabric.

Law firms sell judgment and discretion, and their clients increasingly audit both. Institutional clients with their own security programs send outside-counsel security questionnaires before engagement — long forms covering identity management, encryption, network architecture and incident response — and the answers decide whether the firm can accept the work. The partnership's economics add a constraint most businesses do not have: every hour spent on security process is an hour not billed, so a program that made daily work slower would be resisted quietly and abandoned loudly. Any security model the firm adopted had to assume breach, protect privileged files, and do it all without adding friction to court deadlines and client calls.

Where Things Stood

The firm's technical foundation contradicted its confidentiality obligations. Office networks were flat, so a laptop compromised in one practice group could reach systems across the firm. Remote access ran on always-on VPN, which granted broad network trust to whatever device connected — including the growing population of unmanaged personal devices that remote work had multiplied. A maze of shared service accounts held the whole structure together, none of them individually owned, none of them rotated on any schedule. Auditors found departed employees whose access had never been revoked, some months after their departure, because offboarding ended at the farewell email.

Law firm operations made each of those habits harder to break than they would be elsewhere. Case teams formed and dissolved with every matter, so access grants accumulated the way teams do; co-counsel and expert consultants were granted network access by whoever sponsored them, on whatever terms the case required; and the four offices had grown their own local conventions for file shares and admin accounts over fifteen years of mostly independent administration. Nobody had ever drawn the full picture, and the firm's part-time approach to security governance had never asked for one.

The reckoning arrived through a prospective client's outside-counsel security questionnaire, which returned 41 gaps and put a $12M annual engagement on hold until the firm could prove its controls. The managing partners did not need a security education to understand the exposure: one stolen credential could expose privileged case files, trigger malpractice claims and force breach notification to hundreds of clients. IBM Security's 2024 research puts the average US breach cost at $9.36 million — a figure that lands hardest on data-dense professional-services firms — and the Verizon Data Breach Investigations Report finds 68% of breaches involve a non-malicious human element such as a phishing click or mishandled credential, which described the firm's shared-account and over-privileged habits precisely. The firm needed security built on the assumption of breach, and it needed the $12M engagement back.

The Challenge

The challenge was architectural and cultural at once. Architecturally, the firm needed to move from implicit network trust — once you are on the VPN, you belong — to continuous, per-session verification of identity, device and privilege, which is the model NIST's zero-trust architecture standard, SP 800-207, prescribes. That transition touches every login, every file access and every remote session in a 240-user partnership, so sequencing and change management mattered as much as the controls themselves.

Culturally, the program had to earn the partnership's consent by visibly protecting billable work. Attorneys work to court deadlines from courtrooms, client offices and airports; a security rollout that interrupted trial preparation in any office would have killed the program politically. The 41 questionnaire gaps also carried a clock: the prospective client wanted evidence within two quarters, which meant the controls that answered the questionnaire had to land first, and the deeper architecture had to follow without renegotiating attention. The firm's size was actually an advantage — small enough to move in quarterly waves, large enough to need real engineering — but only if every wave left daily work measurably easier, not harder.

Discovery and Diagnosis

Emerson Technology began with a five-week discovery across all four offices, combining network mapping, an identity census and workflow interviews with partners, associates and the support staff who keep litigation operations running. The identity census was the foundational exercise: employees, contractors, vendors and service accounts across all systems, each catalogued with its owner, its privilege level and its last use. It confirmed the auditors' findings about departed employees and produced the number that anchored the program's goal — 64 privileged accounts, most of them blanket admin rights accumulated over years, none of them justified by a current business need.

Network mapping showed the flat office topology and traced exactly which systems an attacker could reach from a single compromised laptop, a blast-radius analysis partners found more persuasive than any abstract risk score. Workflow interviews mapped how attorneys actually access case files — from the document management system, on managed desktops in offices and unmanaged laptops at home, sometimes through co-counsel sharing arrangements negotiated case by case. The diagnosis organized the findings into a NIST SP 800-207-aligned target state with a quarterly wave plan: identity first, segmentation and privilege second, monitoring and recertification third, with the outside-counsel questionnaire's 41 gaps mapped onto the earliest waves so the $12M engagement's evidence requirements were met on schedule.

The Solution

The program followed the NIST SP 800-207 zero-trust model, delivered in quarterly waves so that no office lost a billable day.

Identity as the perimeter

Identity became the firm's perimeter. A centralized single sign-on platform federated every application the firm operates, with enforced authentication policies, so each application moved inside the monitored boundary instead of carrying its own local password — every app left outside the identity provider is an unmonitored side door attackers probe first. Phishing-resistant MFA rolled out to all 240 users, beginning with administrators and finance staff, because this single control defeats most credential-stuffing and phishing attempts at minimal cost. Device-health checks now gate access to the document management system: unmanaged personal laptops can still reach email, while the vault of case files stays protected from unknown endpoints. Password-reset tickets fell 38% as single sign-on spread, which turned the security change into a daily convenience attorneys noticed positively.

Segmentation and the least-privilege reset

Micro-segmentation split each office network into practice-group zones with explicit firewall rules, restricting east-west traffic so one compromised laptop could no longer reach everything — segmentation designed around data sensitivity rather than office floor plans. Every shared service account was vaulted, rotated automatically and tied to a named owner, ending the anonymous credentials that make lateral movement easy. Least-privilege role reviews replaced blanket admin rights across the firm, cutting privileged accounts from 64 to 19, each of the remaining accounts justified, scoped and monitored. The privilege reduction was performed with department by department review rather than fiat, so no attorney lost access they could demonstrate needing.

Watching sessions, recertifying access

A managed SIEM with identity-threat detection watches every session for impossible-travel and privilege-escalation patterns, converting the firm's sign-in activity from an unaudited stream into an analyzed one. Quarterly access recertification now runs through automated workflow approvals instead of email chains — managers approve or revoke each entitlement on a schedule, and the cycle that once consumed three weeks of chasing closes in four days. Vendors and co-counsel enter through brokered, time-boxed remote sessions recorded end to end, so external collaborators keep their access while the firm gains an audit trail and instant revocation for every engagement that ends.

The First 90 Days

The first quarter executed the identity wave end to end. Weeks one through four completed the identity census and deployed single sign-on in audit mode, federating the first tranche of applications. Weeks five through eight rolled phishing-resistant MFA across all 240 users — administrators and finance first, then attorneys by office — with enrollment sessions timed to avoid trial calendars and a support channel staffed through each wave. The device-health gate went live for the document management system in the same window, with a pre-enrolled managed device fleet so no attorney lost file access on rollout day.

Weeks nine through twelve delivered the first segmentation wave in one office as a template, the vaulting and automatic rotation of the shared service accounts, and the launch of the SIEM's identity-threat detection with a two-week tuning period. The first quarterly access recertification cycle ran on the new workflow tooling and closed in four days instead of the historical three weeks, giving the firm its first reproducible evidence artifact. By day 90, departed-employee access was revoked same-day by construction, the second office's segmentation wave was scheduled, and the outside-counsel questionnaire's identity-related gaps had been answered with system-generated evidence rather than assertions — the difference between a claim and a proof.

The Results

Privileged accounts fell from 64 to 19, and the outside-counsel questionnaire now returns zero critical findings — the $12M engagement was signed in the first quarter after rollout. Quarterly access reviews that once took three weeks close in four days, and password-reset tickets dropped 38% as single sign-on spread. The firm renewed cyber-insurance coverage at a lower premium after its first clean control audit, and partners report no measurable friction in daily court or client work.

The zero-trust posture changed the firm's risk arithmetic in ways the metrics only sketch. A compromised laptop now yields an attacker one session to one zone instead of a network; a departed employee's credentials die the day the departure is recorded; and every co-counsel session produces a recording that would settle any later dispute about what was accessed and when. Institutional clients noticed — the firm's security answers went from a liability in vendor reviews to a credential that shortens them. The clean control audit also did something quietly important inside the partnership: it demonstrated that rigorous security and a billable practice are compatible, which makes the next wave of controls a routine decision instead of a negotiation.

What Your Business Should Do

The Blackwood & Reyes sequence works for any professional organization with confidential data and limited security staff. Inventory every identity before buying anything — list employees, contractors, vendors and service accounts across all systems, and name an owner for each, because zero-trust programs stall on unknown service accounts, not on tool selection. Make phishing-resistant MFA your first move, rolling hardware keys or platform authenticators to administrators and finance staff first and everyone else next; this single control defeats most credential-stuffing and phishing attempts at minimal cost. Federate applications behind one identity provider with enforced authentication policies, since every app left outside it is an unmonitored side door attackers probe first. Segment by data sensitivity rather than office floor — split the network into zones around systems like document management and finance, with explicit rules restricting east-west traffic so one compromised laptop cannot reach everything.

Vault and rotate all service accounts, moving credentials into a secrets vault with automatic rotation and named ownership to remove the shared-password habits that make lateral movement easy. Gate your most sensitive applications on device health, requiring managed, patched devices for core data while unmanaged personal laptops still reach email — a compromise that protects the vault without surveilling everyone's personal machine. Automate quarterly access recertification with workflow tooling that prompts managers to approve or revoke each entitlement on a schedule, catching orphaned accounts that manual reviews miss. Finally, broker and record vendor remote access through a jump host with time-boxed credentials and full session recording, so third parties keep their access while you gain an audit trail and instant revocation. Carry these eight steps through your own rollout with the action checklist in this practice book, and let the reflection questions frame each quarterly partner review: if a partner's laptop were compromised tomorrow, how many other systems could an attacker reach from it, when did you last verify that every departed employee lost access the same day, and how long would it take your team to detect privilege escalation on an admin account — hours, days, or never?