Sample Security Audit — Whitfield & Gray LLP

1 · Executive Summary

Whitfield & Gray's real exposure is not Hollywood hacking — it's quiet mailbox compromise followed by wire-fraud social engineering, plus attorney-client privilege resting on a shared IMAP mailbox with password-level protection. Clio (practice management) is well-secured and already MFA-enforced; the firm's self-hosted pieces are not. Email is IMAP hosted at the registrar with no MFA support offered at all — that single finding drives the overall rating. A 14-minute consented mailbox review (partner-authorized) found privileged documents forwarded to personal Gmail, an "invoices@halemercer" style thread where a paralegal nearly sent a $12,400 settlement wire to a look-alike domain in August (caught by the bank, not by any firm control), and six attorney devices syncing the same mailbox with no remote-wipe capability.

2 · Assets & Crown Jewels

Asset	Data held	Impact if lost/public
Registrar-hosted email (6 seats, IMAP)	20 years of privileged correspondence, settlement terms, client identifiers	CRITICAL privilege breach, bar discipline, malpractice exposure, wire-fraud pivot point
Trust account operating process (email-based approvals)	Client trust funds — ≈$340K average float	CRITICAL direct theft of client money; IOLTA violations
NAS file server (Synology, closet)	Closed-matter archives, scanned discovery	HIGH privilege exposure, no off-site copy
Clio practice management	Active matters, billing, calendar	MEDIUM (vendor SOC 2, MFA on, daily export — well-run)
6 attorney laptops (3 personal)	Full mailbox cache on each	HIGH lost-laptop = reportable breach; no remote wipe

3 · Findings & Severity

#	Finding	Detail	Severity
F1	Email platform cannot do MFA	Registrar IMAP offers no 2FA at all. Every mailbox is one reused password from breach. Password "Justice2019!" appears in two public breach corpora (haveibeenpwned check, consented).	CRITICAL
F2	Trust-wire instructions approved over email with no out-of-band verification	August near-miss: look-alike domain (whitfieid-gray.com — one letter) requested a settlement re-wire. Only the bank's callback caught it.	CRITICAL
F3	SPF exists; DKIM/DMARC absent	Anyone can send "from" whitfield-gray.com and pass basic filters. Trivial for a fraudster to impersonate the firm to its own clients.	HIGH
F4	Privileged material forwarded to personal Gmail	2 of 3 partners do this "for reading at home." Gmail security posture then becomes the firm's security posture — unaudited, unowned.	HIGH
F5	NAS has no off-site/immutable backup	One closet fire or crypto-locker away from archive loss. NAS is internet-reachable for "convenient" remote access (Synology QuickConnect open).	HIGH
F6	No endpoint management or remote wipe	6 devices cache the entire mailbox; none enrolled in MDM; 1 laptop full-disk encryption unknown/unverified.	MEDIUM
F7	Guest/client Wi-Fi shares LAN with NAS	Waiting-room clients sit 18 network hops from nothing — they're directly adjacent to the archive server.	MEDIUM
F8	No phishing-awareness cadence	Staff are conscientious; they simply have never been shown modern BEC lures. Consented test: 4/5 clicked the fake DocuSign link.	LOW

4 · Threat Model — most probable attack paths

T1 · BEC / settlement-fund diversion

Likelihood high, impact critical. Watch mailbox (F1) → learn matter cadence → inject look-alike domain at wire time (F2+F3) → trust funds out. The August attempt already happened once; nothing structural has changed since.

T2 · Privilege breach via lost device or Gmail pivot

6 unmanaged mailbox caches (F6) + personal-Gmail forwards (F4) widen the privilege surface beyond anything the firm can see or revoke.

T3 · Ransomware on the NAS

Internet-exposed QuickConnect (F5) + no off-site copy = a commodity ransomware family could erase the archive in an evening.

Attack narrative · T1 mapped to MITRE ATT&CK

TA0043 Reconnaissance — court dockets + firm site reveal active matters, attorney names, opposing counsel (T1593 open-source)
TA0001 Initial Access — credential phishing or simple reuse (T1078 valid accounts) against MFA-less mailbox (F1)
TA0009 Collection — silent mailbox rules auto-forwarding wires/discovery threads (T1114.003 hidden rule, observed patterns in BEC cases)
TA0010 Exfiltration — settlement instructions harvested (T1567) for weeks, undetected
Execution — spoofed "attorney" email (F3 enables perfect impersonation) redirects the wire (F2: no verification step). Loss: one settlement.

5 · Risk Matrix (likelihood × impact)

Impact →

LowModerateHighSevereExistential Likely

T1F1

Possible

T2F3·F4·F6

Unlikely

T3F5

Rare

Overall 6.9/10. Primary drivers: an MFA-incapable mail platform with known-compromised credentials, and a money-movement workflow with no human verification step. Both are one-week fixes, which is what makes the current exposure indefensible — including, candidly, under ABA Rule 1.6(c)'s "reasonable efforts" standard.

6 · Remediation Roadmap

Days 1–3 — Move email to Microsoft 365 Business Premium with enforced MFA ≈ $22/user/mo + $300 migration labor

Registrar IMAP retired. Conditional access blocks legacy protocols. Six breached passwords burned and replaced.

Days 1–3 — Wire-verification protocol $0

Written rule: no wire, ACH change, or "new account detail" honored without a call to a number already on file — never the number in the email. One laminated card per desk. The August attempt dies against this rule every time.

Week 1 — DMARC/DKIM/SPF hardening included in migration

Full email-auth chain at p=reject after a 2-week monitor window. Outsiders can no longer spoof the firm's own domain to its clients.

Week 2 — Endpoint management + encryption M365-included Intune

All 6 devices enrolled; BitLocker enforced; remote wipe verified with a live test. Personal Gmail forwards off via mail-flow rule.

Week 2 — NAS off the internet, backed up off-site ≈ $240 + $12/mo

QuickConnect closed; VPN-only access; immutable cloud copy with 1-year retention. Monthly automated restore checksum.

Week 3 — Guest VLAN + phishing cadence $180 one-time + $6/user/mo

Waiting-room Wi-Fi isolated to internet-only. Quarterly 10-minute simulated phish with micro-training on failures.

7 · Residual Risk Statement

After Phase 1: projected 2.9/10 (LOW). Wire fraud falls to process risk (the call-back rule), email compromise to credential-phishing residuals (M365 phishing-resistant MFA available as Phase 2 upgrade). ABA ethics-opinion alignment documented for the file. Re-score in 90 days; annual re-audit recommended given practice growth.