Latest / AI Tools for Practicing Lawyers / Field Note: Which is More Secure, Google or Microsoft?

Transcript

Field Note: Which is More Secure, Google or Microsoft? · AI Tools for Practicing Lawyers

• 0:03
  SPEAKER_00: Welcome to AI Tools for Practicing Lawyers.
• 0:07
  SPEAKER_00: Practical, no-nonsense guidance to help attorneys put AI power to work in their practice right now.
• 0:14
  SPEAKER_01: Google or Microsoft?
• 0:16
  SPEAKER_01: For most lawyers, that's a question about email, word processing, document storage, maybe how much they like Outlook versus Gmail.
• 0:25
  SPEAKER_01: But there's another question that deserves just as much attention.
• 0:30
  SPEAKER_01: Which one does a better job of protecting your clients' confidential information?
• 0:36
  SPEAKER_01: I've recently devoted two episodes of AI builds to security in Google Worksplace and Microsoft 365.
• 0:45
  SPEAKER_01: Today I want to compare them, not by taking you through another series of administrative settings, but by identifying the security features that lawyers should care about.
• 0:57
  SPEAKER_01: And here's something important.
• 1:00
  SPEAKER_01: The answer isn't necessarily that one platform is more secure than the other.
• 1:06
  SPEAKER_01: The answer may depend on which features you've purchased, whether you've turned them on, and how your people use them.
• 1:14
  SPEAKER_01: I'm Ron Drescher, and this is an AI Tools for Practicing Lawyers Field Note.
• 1:20
  SPEAKER_01: So let's start with the front door.
• 1:23
  SPEAKER_01: Both Google and Microsoft offer multi-factor authentication.
• 1:27
  SPEAKER_01: That's the familiar process where you enter your password and then verify your identity using your phone or another device.
• 1:36
  SPEAKER_01: But increasingly, both companies are moving towards something better: pass keys and phishing-resistant authentication.
• 1:45
  SPEAKER_01: Why does that matter?
• 1:47
  SPEAKER_01: Because criminals have gotten really good at stealing passwords.
• 1:51
  SPEAKER_01: They've become really good at tricking people into supplying six-digit authentication codes.
• 1:59
  SPEAKER_01: I mean, it's mind-boggling how successful these phish and other scams really are.
• 2:07
  SPEAKER_01: Pass keys and physical security keys can make those attacks considerably harder.
• 2:13
  SPEAKER_01: For a law firm, I'd put phishing resistant authentication near the top of the security shopping list.
• 2:22
  SPEAKER_01: But my verdict about Google versus Microsoft, it's essentially a tie.
• 2:27
  SPEAKER_01: I mean, they're both fantastic systems.
• 2:30
  SPEAKER_01: They offer strong identity protections.
• 2:33
  SPEAKER_01: But what matters is whether your firm requires them, particularly for admins and anyone who can access, particularly for admins and anyone who can access confidential client files.
• 2:47
  SPEAKER_01: And here's where things get interesting.
• 2:50
  SPEAKER_01: Google has Google Drive, Microsoft has OneDrive and SharePoint.
• 2:55
  SPEAKER_01: Both make it remarkably easy to share documents.
• 2:59
  SPEAKER_01: And that's both their greatest strength and potentially their greatest security problem.
• 3:05
  SPEAKER_01: Suppose your Paralegal creates a folder containing a client's tax returns, bank statements, and bankruptcy schedules.
• 3:13
  SPEAKER_01: She wants to share it with the client.
• 3:15
  SPEAKER_01: But instead of granting access to that particular client, she creates a link that anyone possessing can open.
• 3:24
  SPEAKER_01: Now you've created unnecessary exposure.
• 3:28
  SPEAKER_01: Both platforms allow admins to restrict external sharing, manage permissions, and control how links work.
• 3:37
  SPEAKER_01: Microsoft has particularly extensive SharePoint and OneDrive sharing controls.
• 3:43
  SPEAKER_01: Google's sharing controls are integrated into a relatively straightforward workspace environment.
• 3:50
  SPEAKER_01: But here's what I would want to know as a managing partner.
• 3:53
  SPEAKER_01: Can someone in my office accidentally share a confidential client folder with the entire internet?
• 4:01
  SPEAKER_01: And if the answer is yes, what are we doing about it?
• 4:04
  SPEAKER_01: My verdict, both can be configured securely.
• 4:08
  SPEAKER_01: The important feature isn't how easily you can share something, it's how effectively you can prevent someone from sharing it with the wrong person.
• 4:21
  SPEAKER_01: Now we get to a feature that I think deserves much more attention from lawyers.
• 4:26
  SPEAKER_01: It's called data loss prevention or DLP.
• 4:31
  SPEAKER_01: Imagine an associate accidentally attempts to email a spreadsheet containing dozens of Social Security numbers to someone outside the firm.
• 4:41
  SPEAKER_01: I'm scared just thinking about that.
• 4:44
  SPEAKER_01: Or a staff member tries to share a folder containing sensitive financial records with an unauthorized recipient.
• 4:53
  SPEAKER_01: Wouldn't it be fantastic if the system could recognize that something sensitive was happening and intervene?
• 5:00
  SPEAKER_01: That's what DLP is designed to do.
• 5:03
  SPEAKER_01: Google offers DLP capabilities in qualifying workspace editions.
• 5:09
  SPEAKER_01: Microsoft offers DLP through Microsoft Purview with capabilities that vary by license.
• 5:15
  SPEAKER_01: Microsoft's information protection ecosystem also includes sensitivity labels that can classify documents and apply protections.
• 5:25
  SPEAKER_01: This is a particularly interesting area for firms handling large volumes of confidential information.
• 5:33
  SPEAKER_01: But there's a catch.
• 5:36
  SPEAKER_01: You may not have these capabilities in your current subscription.
• 5:40
  SPEAKER_01: Google reserves some advanced DLP features for particular additions.
• 5:45
  SPEAKER_01: Microsoft also differentiates between basic and advanced protections.
• 5:51
  SPEAKER_01: My advice: don't simply ask whether your firm has DLP.
• 5:56
  SPEAKER_01: Ask whether your particular subscription includes it, what information it protects, and whether anyone has configured it.
• 6:08
  SPEAKER_01: Here's another scenario.
• 6:10
  SPEAKER_01: Your associate forgets her laptop in an Uber.
• 6:13
  SPEAKER_01: It contains access to client emails, documents, perhaps your practice management system.
• 6:20
  SPEAKER_01: What happens next?
• 6:22
  SPEAKER_01: Both Google and Microsoft offer ways to manage devices and restrict access.
• 6:28
  SPEAKER_01: But Microsoft has a particularly compelling offering for small law firms.
• 6:33
  SPEAKER_01: It's called Microsoft 365 Business Premium.
• 6:37
  SPEAKER_01: That subscription includes Microsoft Intune for device management and Microsoft Defender for Business for endpoint security.
• 6:46
  SPEAKER_01: These tools can help a firm enforce security requirements, manage devices, and respond to threats.
• 6:54
  SPEAKER_01: Google offers endpoint management and device-based access controls as well, although the capabilities depend, once again, on the workspace edition and configuration.
• 7:06
  SPEAKER_01: For a law firm with a collection of Windows computers, Microsoft has an attractive integrated security proposition.
• 7:14
  SPEAKER_01: I'd probably give Microsoft an advantage here, although, as a longtime Mac user, I'm not so sure that would apply to me.
• 7:22
  SPEAKER_01: But for firms that want to manage Windows devices and Microsoft 365 together, it's a powerful tool.
• 7:31
  SPEAKER_01: But the advantage disappears quickly if nobody actually deploys and manages the tools.
• 7:39
  SPEAKER_01: Now we come to my favorite topic: artificial intelligence.
• 7:43
  SPEAKER_01: Suppose someone in your office discovers a wonderful AI app.
• 7:47
  SPEAKER_01: It promises to organize client docs, summarize emails, or analyze financial records.
• 7:54
  SPEAKER_01: And to make everything work, it asks for permission to connect to your Google Drive or Microsoft OneDrive.
• 8:01
  SPEAKER_01: Your employee clicks allow.
• 8:04
  SPEAKER_01: What just happens?
• 8:06
  SPEAKER_01: Potentially, your employee gave an outside application access to confidential client information.
• 8:13
  SPEAKER_01: And that brings me to something I've discussed frequently on this podcast: folder mania, the ability to give an AI application access to an entire folder rather than uploading documents individually.
• 8:26
  SPEAKER_01: That's extremely powerful, but it also raises the stakes.
• 8:31
  SPEAKER_01: Both Google and Microsoft provide admin controls for managing third-party app access.
• 8:39
  SPEAKER_01: Google offers API controls and application access policies.
• 8:44
  SPEAKER_01: Microsoft offers app consent controls to UNTRA, along with additional governance capabilities depending on licensing.
• 8:53
  SPEAKER_01: This is one area where I wouldn't declare a winner.
• 8:57
  SPEAKER_01: Instead, I'd ask a much more important question.
• 9:00
  SPEAKER_01: Does your firm know which outside applications have access to its documents and emails?
• 9:06
  SPEAKER_01: You gotta know that.
• 9:07
  SPEAKER_01: And who has the authority to approve those connections?
• 9:11
  SPEAKER_01: Because your cloud platform might be beautifully secured while an authorized third-party application creates an entirely different exposure.
• 9:22
  SPEAKER_01: And what about Google's Gemini and Microsoft's co-pilot?
• 9:26
  SPEAKER_01: Both companies are integrating AI into their productivity ecosystems.
• 9:31
  SPEAKER_01: For lawyers, that creates enormous opportunities.
• 9:34
  SPEAKER_01: Imagine asking AI to summarize correspondence, locate documents, or prepare a chronology from materials already in your firm's files.
• 9:44
  SPEAKER_01: But it introduces a new question: What information can the AI retrieve?
• 9:50
  SPEAKER_01: Generally, enterprise AI tools are designed to operate within existing access permissions.
• 9:58
  SPEAKER_01: That's reassuring.
• 9:59
  SPEAKER_01: But think about what happens if those permissions are already too broad.
• 10:04
  SPEAKER_01: If everyone in the firm can access a folder, an AI assistant operating with those permissions may also be able to retrieve information from that same folder.
• 10:15
  SPEAKER_01: AI doesn't necessarily create the underlying permissions problem.
• 10:19
  SPEAKER_01: It can make that problem much easier to discover and exploit.
• 10:25
  SPEAKER_01: So before enabling Gemini or Copilot across your firm, I would want a review of document permissions and sharing practices.
• 10:34
  SPEAKER_01: And I would want to understand the applicable contractual commitments concerning data use, retention, and model training.
• 10:43
  SPEAKER_01: My verdict: both platforms offer substantial AI capabilities, but neither eliminates the need for careful access controls.
• 10:55
  SPEAKER_01: Here's something that surprised me as I researched these episodes.
• 10:59
  SPEAKER_01: The difference between a basic subscription and a more sophisticated business subscription can be enormous.
• 11:07
  SPEAKER_01: With Microsoft, business premium is worth a serious look because of the security capabilities bundled with it.
• 11:14
  SPEAKER_01: With Google, the advanced security features you want may require moving to a higher workspace edition.
• 11:22
  SPEAKER_01: And this is why I wouldn't make a purchasing decision.
• 11:26
  SPEAKER_01: And this is why I wouldn't make a purchasing decision based solely on the monthly subscription price.
• 11:33
  SPEAKER_01: The real question is, what security capabilities does my law firm actually need?
• 11:39
  SPEAKER_01: And what will it cost to get them?
• 11:43
  SPEAKER_01: A cheaper subscription that doesn't provide the protections you need may not be cheaper in any meaningful sense.
• 11:51
  SPEAKER_01: And a more expensive subscription that nobody configures properly may really provide very little additional protection.
• 12:01
  SPEAKER_01: And this brings me back to something I've also talked about before.
• 12:05
  SPEAKER_01: My three-legged stool of AI security: technology, configuration, and people.
• 12:12
  SPEAKER_01: Google and Microsoft provide excellent technology.
• 12:16
  SPEAKER_01: Your firm or whoever manages its IT is responsible for the configuration.
• 12:23
  SPEAKER_01: And your lawyers and staff are responsible for how they use it.
• 12:27
  SPEAKER_01: Take away any of those legs, the stool falls over.
• 12:31
  SPEAKER_01: So which would I choose?
• 12:34
  SPEAKER_01: If I were running a firm heavily invested in Windows computers, Outlook and Word, I would take a serious look at Microsoft 365 business premium.
• 12:44
  SPEAKER_01: My firm was already operating comfortably in Google Workspace, I wouldn't switch merely because someone told me Microsoft was more secure.
• 12:54
  SPEAKER_01: I'd make sure I had the right Google subscription and that the appropriate protections were enabled.
• 13:00
  SPEAKER_01: And whichever platform I chose, I'd want answers to five questions.
• 13:05
  SPEAKER_01: Who can access our client information?
• 13:08
  SPEAKER_01: Who can share it outside the firm?
• 13:11
  SPEAKER_01: Which outside applications connect to it?
• 13:14
  SPEAKER_01: What happens when a device is lost or compromised?
• 13:18
  SPEAKER_01: And can we identify and respond to suspicious activity?
• 13:23
  SPEAKER_01: If you can answer those five questions confidently, you're well on your way to understanding your firm's security posture.
• 13:31
  SPEAKER_01: If you can't, you have some work to do.
• 13:35
  SPEAKER_01: I've prepared separate AI builds episodes on securing Google Workspace on Microsoft 365, along with companion materials to help you find the relevant settings.
• 13:47
  SPEAKER_01: You'll find those resources in the show notes.
• 13:49
  SPEAKER_01: I'm Ron Drescher, and this has been an AI Tools for Practicing Lawyers field note.
• 13:55
  SPEAKER_01: See you next time.
• 13:58
  SPEAKER_00: That's it for today's episode of AI Tools for Practicing Lawyers.
• 14:02
  SPEAKER_00: Thanks for listening.
• 14:04
  SPEAKER_00: We'll see you next time.