Latest / AI Tools for Practicing Lawyers / AI Builds: How Secure is Microsoft?

Transcript

AI Builds: How Secure is Microsoft? · AI Tools for Practicing Lawyers

• 0:03
  SPEAKER_00: Welcome to AI Tools for Practicing Lawyers.
• 0:07
  SPEAKER_00: Practical, no-nonsense guidance to help attorneys put AI power to work in their practice right now.
• 0:15
  SPEAKER_01: If you're a practicing lawyer, there's a pretty good chance that Microsoft knows more about your law practice than almost anybody else.
• 0:24
  SPEAKER_01: Your emails may be in Outlook, your documents are certainly in Word, and your spreadsheets are in Excel.
• 0:31
  SPEAKER_01: Your client files, they might be sitting in OneDriver SharePoint.
• 0:35
  SPEAKER_01: And increasingly, Microsoft wants to put artificial intelligence right in the middle of all of it.
• 0:42
  SPEAKER_01: To me, that sounds pretty convenient.
• 0:44
  SPEAKER_01: Imagine asking an AI assistant to find an email from a client, summarize a deposition transcript, locate a financial statement, or prepare a first draft of a motion.
• 0:56
  SPEAKER_01: But there's another side to that convenience.
• 0:59
  SPEAKER_01: What happens when your AI assistant can see documents that you didn't realize you were sharing?
• 1:05
  SPEAKER_01: What happens when an associate in your firm can use AI to discover confidential information about a client the associate doesn't represent?
• 1:16
  SPEAKER_01: And what happens when you connect an outside AI application to your Microsoft account?
• 1:21
  SPEAKER_01: Does Microsoft protect you?
• 1:23
  SPEAKER_01: Or have you just handed somebody the keys to your law office?
• 1:27
  SPEAKER_01: Today we're going to explore those questions.
• 1:30
  SPEAKER_01: I'm Ron Drescher and welcome to another edition of AI Builds from AI Tools for Practicing Lawyers.
• 1:37
  SPEAKER_01: So today, how Secure is Microsoft?
• 1:41
  SPEAKER_01: If you listen to our companion episode, How Secure is Google, you already know that I have a particular way of looking at cybersecurity.
• 1:51
  SPEAKER_01: I call it the three-legged stool.
• 1:53
  SPEAKER_01: And we're going to come back to that in just a few minutes.
• 1:56
  SPEAKER_01: But first, let's talk about Microsoft.
• 2:00
  SPEAKER_01: Microsoft is not an obscure tech company asking you to trust it with your client information.
• 2:07
  SPEAKER_01: It's one of the largest tech companies in the world.
• 2:11
  SPEAKER_01: In fact, many, many IT companies have made small fortunes specializing only in supporting Microsoft products.
• 2:24
  SPEAKER_01: And that's especially prevalent and that's especially prevalent in the legal field.
• 2:30
  SPEAKER_01: For decades, Microsoft has been providing the basic tools that lawyers use to practice law: Word, Excel, Outlook, PowerPoint.
• 2:42
  SPEAKER_01: But today's Microsoft is very different from the company that sold us software on CDs, if any of you can remember that far back.
• 2:52
  SPEAKER_01: Microsoft 365 is an interconnected cloud environment.
• 2:56
  SPEAKER_01: Your email may live in exchange online.
• 3:00
  SPEAKER_01: Your personal working documents may live in OneDrive.
• 3:04
  SPEAKER_01: Your firm's shared documents may live in SharePoint.
• 3:07
  SPEAKER_01: Your conversations and meetings may take place in Teams.
• 3:12
  SPEAKER_01: And Microsoft Entra manages the identities and permissions that determine who gets access to all of these things.
• 3:21
  SPEAKER_01: Now, ad co-pilot Microsoft's family of artificial intelligence products.
• 3:28
  SPEAKER_01: And suddenly, these aren't just separate applications.
• 3:31
  SPEAKER_01: They're potential sources of information for an AI assistant.
• 3:36
  SPEAKER_01: And that's where things get interesting.
• 3:39
  SPEAKER_01: Because the question we're asking today isn't whether Microsoft has good security.
• 3:45
  SPEAKER_01: Of course it does.
• 3:47
  SPEAKER_01: It has to.
• 3:48
  SPEAKER_01: The question is whether your law firm is using Microsoft security tools correctly.
• 3:55
  SPEAKER_01: Those are two very different things.
• 3:58
  SPEAKER_01: And there's something else worth remembering.
• 4:00
  SPEAKER_01: Microsoft 365 isn't just one product, it's a collection of products with different features, different administrative settings, and different subscription levels.
• 4:12
  SPEAKER_01: So when somebody tells you that Microsoft has a particular security feature, there are two questions you need to ask.
• 4:21
  SPEAKER_01: First, does my subscription include it?
• 4:24
  SPEAKER_01: And second, is it turned on?
• 4:27
  SPEAKER_01: Because those are not the same things.
• 4:30
  SPEAKER_01: Let's return to the three-legged stool.
• 4:33
  SPEAKER_01: I personally think it's a useful way for lawyers to understand cybersecurity.
• 4:39
  SPEAKER_01: The first leg is the technology provider.
• 4:43
  SPEAKER_01: In this case, Microsoft.
• 4:45
  SPEAKER_01: Microsoft is responsible for protecting its infrastructure, securing its cloud services, maintaining its systems, and providing tools to control access to information.
• 4:57
  SPEAKER_01: Microsoft spends enormous amounts of money doing those things.
• 5:02
  SPEAKER_01: The second leg is your law firm.
• 5:09
  SPEAKER_01: Your firm decides which employees can access which documents.
• 5:14
  SPEAKER_01: Your firm decides whether outside sharing is permitted.
• 5:19
  SPEAKER_01: Your firm decides whether multi-factor authentication is required.
• 5:24
  SPEAKER_01: And your firm decides which outside applications can connect to its Microsoft environment.
• 5:32
  SPEAKER_01: The third leg is the individual user.
• 5:35
  SPEAKER_01: That's you and your associates and your paralegals and everybody else who has access to the firm's systems.
• 5:43
  SPEAKER_01: Because even a properly configured system can be undermined when somebody approves a suspicious sign-in request, shares a confidential document with the wrong person, or authorizes an application they don't understand.
• 5:59
  SPEAKER_01: Microsoft can provide excellent security, but it can't always protect you from giving somebody the key.
• 6:07
  SPEAKER_01: And artificial intelligence makes understanding that distinction more important than ever.
• 6:14
  SPEAKER_01: Before we talk about the risks, I want to give Microsoft some credit as if it needs it.
• 6:20
  SPEAKER_01: Microsoft 365 provides a sophisticated collection of security technologies.
• 6:26
  SPEAKER_01: For example, Microsoft encrypts information as it travels between your computer and its cloud services.
• 6:34
  SPEAKER_01: It also encrypts stored information.
• 6:37
  SPEAKER_01: Microsoft provides multi-factor authentication, which makes it much harder for someone to gain access to your account merely by stealing your password.
• 6:47
  SPEAKER_01: Microsoft offers tools to detect suspicious sign-ins, manage devices, control access, and investigate security incidents.
• 6:58
  SPEAKER_01: And depending on your subscription, you may have access to additional protections against phishing, malware, ransomware, and accidental disclosure of confidential information.
• 7:11
  SPEAKER_01: Microsoft also provides auditing tools that can help administrators determine who accessed information and what activities occurred.
• 7:21
  SPEAKER_01: Now, here's something I want to emphasize.
• 7:24
  SPEAKER_01: Not every Microsoft 365 subscription includes the same security capabilities.
• 7:31
  SPEAKER_01: Microsoft 365 Business, Microsoft 365 Business Basic, Business Standard, and Business Premium are not identical.
• 7:43
  SPEAKER_01: Business Premium includes important additional security and device management capabilities.
• 7:50
  SPEAKER_01: And some of Microsoft's more sophisticated compliance and AI governance tools require additional licensing.
• 7:59
  SPEAKER_01: So if somebody tells you that Microsoft has a particular security feature, the next question should be: do I have that feature?
• 8:07
  SPEAKER_01: And is it turned on?
• 8:09
  SPEAKER_01: Because having access to a security feature and actually using it are two very different things.
• 8:15
  SPEAKER_01: And for a small law firm, that's important.
• 8:18
  SPEAKER_01: You don't necessarily need every security product Microsoft sells, but you do need to understand which protections are included in the products you are already paying for.
• 8:30
  SPEAKER_01: Now, I want to talk about one of my favorite subjects, and it was the subject of a prior episode on this podcast, and that's folder mania.
• 8:39
  SPEAKER_01: I've used that term to describe something lawyers have been doing since the earliest days of personal computers.
• 8:47
  SPEAKER_01: In fact, really, even before there were computers, we organize information into folders.
• 8:53
  SPEAKER_01: We have client folders, matter folders, pleadings folders, correspondence folders, discovery folders, probably a folder somewhere called miscellaneous that nobody has opened since 2017.
• 9:07
  SPEAKER_01: There's nothing wrong with folders.
• 9:09
  SPEAKER_01: In fact, they're an excellent way to organize information.
• 9:13
  SPEAKER_01: But when we move those folders into the cloud, something changes.
• 9:17
  SPEAKER_01: The folders aren't just places where documents live, they also become places where access permissions matter.
• 9:26
  SPEAKER_01: Let's say you have a SharePoint site containing documents for 200 clients.
• 9:31
  SPEAKER_01: You've given your associates access to that site because you want them to collaborate.
• 9:37
  SPEAKER_01: Over time, people come and go.
• 9:39
  SPEAKER_01: Permissions change.
• 9:41
  SPEAKER_01: Somebody shares a folder with another employee.
• 9:43
  SPEAKER_01: Somebody creates a link that allows an outside person to view a document.
• 9:48
  SPEAKER_01: And perhaps nobody has reviewed all those permissions in years.
• 9:54
  SPEAKER_01: Now, introduce Microsoft 365 Copilot.
• 9:58
  SPEAKER_01: Depending on the product and configuration, Copilot can help users locate and work with information across their Microsoft 365 environment.
• 10:10
  SPEAKER_01: But here's the important part.
• 10:13
  SPEAKER_01: Copilot generally operates within the permissions that the user already has.
• 10:19
  SPEAKER_01: Now, that sounds reassuring, and in many ways it is.
• 10:23
  SPEAKER_01: Copilot isn't supposed to give an associate access to documents the associate isn't authorized to see.
• 10:30
  SPEAKER_01: But what if the associate already has access to documents that the associate shouldn't be seeing?
• 10:37
  SPEAKER_01: What if your firm's permissions have been too broad for years?
• 10:41
  SPEAKER_01: Copilot may make those documents much easier to discover.
• 10:46
  SPEAKER_01: And that's a fascinating security problem and equally troubling because Copilot hasn't necessarily broken any rules.
• 10:55
  SPEAKER_01: It followed the rules.
• 10:57
  SPEAKER_01: But the rules were wrong.
• 10:59
  SPEAKER_01: This is why Microsoft has devoted massive attention to the problem of oversharing in SharePoint in OneDrive.
• 11:07
  SPEAKER_01: And it's why I think lawyers need to review their document permissions before they begin giving AI assistance broad access to their information.
• 11:17
  SPEAKER_01: Folder mania is wonderful, but when you connect folder mania to artificial intelligence, you'd better understand who can open the folders.
• 11:26
  SPEAKER_01: All right, let's talk about copilot, because this is an area where I think lawyers can become confused very quickly and very understandably.
• 11:37
  SPEAKER_01: Microsoft uses the copilot name for several different experiences.
• 11:43
  SPEAKER_01: There's consumer copilot, there's mo there's Microsoft, there's Microsoft 365 Copilot Chat, which eligible business users can access with enterprise data protection.
• 11:57
  SPEAKER_01: And then there's the more fully integrated Microsoft 365 Copilot, which can work with organizational information that the user is authorized to access.
• 12:08
  SPEAKER_01: These products don't all have the same capabilities, and you shouldn't assume that every application displaying the copilot name provides the same protections.
• 12:19
  SPEAKER_01: For example, Microsoft states that prompts and responses and its enterprise-protected Microsoft 365 copilot experiences are not used to train the underlying foundation models.
• 12:33
  SPEAKER_01: That's an important protection.
• 12:35
  SPEAKER_01: But it doesn't mean that every application connected to Microsoft has the same contractual terms or data handling practices.
• 12:45
  SPEAKER_01: Nor does it mean that every copilot interaction is invisible to your organization.
• 12:52
  SPEAKER_01: Depending on the service and your firm's configuration, interactions may be subject to auditing, retention, compliance searches, and other organizational controls.
• 13:04
  SPEAKER_01: And that's something lawyers need to understand.
• 13:07
  SPEAKER_01: When you're using AI to help prepare a confidential legal document, or if you're building an AI app, you need to know which product you're using, what information it can access, and what happens to the information you provide.
• 13:23
  SPEAKER_01: Don't assume that because it says Microsoft on the screen, every possible use of the information is automatically appropriate for your practice or your build.
• 13:34
  SPEAKER_01: There's another distinction that's particularly important.
• 13:37
  SPEAKER_01: Using AI to help draft a letter is one thing.
• 13:41
  SPEAKER_01: Giving AI access to years of client emails, documents, and financial records is something else entirely.
• 13:49
  SPEAKER_01: The second situation creates a much larger universe of information that the AI may be able to retrieve or process.
• 13:59
  SPEAKER_01: And that means your permissions become even more important.
• 14:04
  SPEAKER_01: Now we come to something that I think is going to become increasingly critical, and that's third-party AI applications.
• 14:13
  SPEAKER_01: Suppose you discover a terrific new legal AI product.
• 14:17
  SPEAKER_01: Maybe it summarizes documents, maybe it organizes client intake, maybe it reviews financial information, maybe it prepares drafts of legal documents.
• 14:28
  SPEAKER_01: And the product says, connect your Microsoft 365 account.
• 14:34
  SPEAKER_01: You click the button.
• 14:35
  SPEAKER_01: Microsoft asks you to sign in, and then you see a screen requesting permission for the application to access certain information.
• 14:46
  SPEAKER_01: Perhaps it wants to read files.
• 14:48
  SPEAKER_01: Perhaps it wants access to your email.
• 14:50
  SPEAKER_01: Perhaps it wants permission to maintain access even when you're not actively using the application.
• 14:59
  SPEAKER_01: And perhaps you click accept.
• 15:01
  SPEAKER_01: I do it all the time.
• 15:03
  SPEAKER_01: Now, I want to be clear, that doesn't necessarily mean you've done anything wrong.
• 15:08
  SPEAKER_01: Many legitimate applications need these permissions to perform the services you're asking them to provide.
• 15:16
  SPEAKER_01: But you need to understand what you're authorizing.
• 15:19
  SPEAKER_01: There's a significant difference between giving an application access to one selected document and authorizing it to read every file your account can access.
• 15:30
  SPEAKER_01: There's also a difference between an application that can access information only while you're using it and one that can maintain access afterward.
• 15:41
  SPEAKER_01: Microsoft Entra provides tools for administrators to review applications and the permissions they've been granted.
• 15:49
  SPEAKER_01: But here's the problem.
• 15:51
  SPEAKER_01: How many small firm lawyers know where to find those settings?
• 15:55
  SPEAKER_01: And how many have even ever looked?
• 15:59
  SPEAKER_01: I suspect, unfortunately, the answer is not very many.
• 16:03
  SPEAKER_01: Which brings us back to our three-legged stool.
• 16:07
  SPEAKER_01: Microsoft can authenticate the application, Microsoft can display the permissions being requested.
• 16:14
  SPEAKER_01: Microsoft can provide controls for administrators, but your firm still has to decide whether those permissions are appropriate.
• 16:23
  SPEAKER_01: And that's particularly important when the information belongs to your clients.
• 16:28
  SPEAKER_01: Here's another point worth mentioning.
• 16:30
  SPEAKER_01: Not every application that connects to Microsoft receives the same kind of access.
• 16:37
  SPEAKER_01: Some applications operate using permissions associated with a particular user.
• 16:43
  SPEAKER_01: Others may request permissions that allow the application itself to access organizational information, potentially without an individual user being signed in.
• 16:55
  SPEAKER_01: Those are very different security arrangements.
• 16:58
  SPEAKER_01: And they deserve very different levels of scrutiny.
• 17:02
  SPEAKER_01: If you're evaluating a legal AI product, ask the vendor what permissions it requires.
• 17:08
  SPEAKER_01: Ask whether those permissions can be limited.
• 17:11
  SPEAKER_01: Ask whether the application stores copies of your documents.
• 17:15
  SPEAKER_01: And ask what happens to your information if you stop using the service.
• 17:20
  SPEAKER_01: Those are reasonable questions for any lawyer to ask.
• 17:24
  SPEAKER_01: Now, I don't want this episode to turn into a Microsoft administration course.
• 17:29
  SPEAKER_01: Nobody wants to listen to me recite 37 menu selections from the Microsoft Admin Center.
• 17:36
  SPEAKER_01: But I do want you to know where to begin.
• 17:39
  SPEAKER_01: And we've prepared a companion downloadable guide that identifies the important locations and settings.
• 17:46
  SPEAKER_01: First, there's the Microsoft 365 Admin Center.
• 17:50
  SPEAKER_01: That's one of the main places where administrators manage users, licenses, and organizational settings.
• 17:58
  SPEAKER_01: Second, there's Microsoft Entra.
• 18:00
  SPEAKER_01: That's where you can investigate identity security, multi-factor authentication, and the applications that have been authorized to access your environment.
• 18:09
  SPEAKER_01: Third, there's the SharePoint Admin Center.
• 18:13
  SPEAKER_01: That's where administrators can review important organizational sharing controls for SharePoint and OneDrive.
• 18:21
  SPEAKER_01: Fourth, there's Microsoft Defender.
• 18:24
  SPEAKER_01: Depending on your subscription, this is where you may find tools for protecting users, devices, emails, and other parts of your environment.
• 18:33
  SPEAKER_01: And fifth, there's Microsoft Purview.
• 18:36
  SPEAKER_01: Purview provides data governance, auditing, and compliance capabilities, although the particular features available do depend on your licensing.
• 18:48
  SPEAKER_01: Okay, here's my suggestion.
• 18:50
  SPEAKER_01: If you're a solo practitioner or you operate a small law firm, you don't need to master all these products.
• 18:58
  SPEAKER_01: But you should be able to answer a few basic questions.
• 19:02
  SPEAKER_01: And more importantly, you should be able to ask a few basic questions.
• 19:07
  SPEAKER_01: Is multi-factor authentication protecting our accounts?
• 19:11
  SPEAKER_01: Who can share client documents outside the firm?
• 19:15
  SPEAKER_01: Do we permit anonymous sharing links?
• 19:18
  SPEAKER_01: Which third-party applications have access to our Microsoft accounts?
• 19:23
  SPEAKER_01: And who has permission to access our confidential client information?
• 19:29
  SPEAKER_01: If you don't know the answers and if you haven't thought of the questions, it's a good conversation to have with whoever manages your technology.
• 19:39
  SPEAKER_01: And if you manage your own technology, our downloadable guide will hopefully give you a place to start with the first one.
• 19:47
  SPEAKER_01: One caution: don't start changing unfamiliar security settings in the middle of a busy workday.
• 19:54
  SPEAKER_01: Some changes can interrupt legitimate access, including access needed by staff and outside collaborators.
• 20:01
  SPEAKER_01: Review first, understand the consequences, then make deliberate changes.
• 20:08
  SPEAKER_01: There's one other subject I want to address ransomware.
• 20:13
  SPEAKER_01: Lawyers sometimes assume that because their documents are stored in OneDrive or SharePoint, they're automatically protected against ransomware.
• 20:22
  SPEAKER_01: Microsoft does provide version histories, recovery capabilities, and other protections, which are immensely valuable.
• 20:31
  SPEAKER_01: But cloud storage is not the same as a complete backup and disaster recover strategy.
• 20:37
  SPEAKER_01: If a malicious actor gains access to your account, deletes information, changes permissions, or compromises multiple systems, your ability to recover may depend on what protections were enabled and how quickly the problem is discovered.
• 20:53
  SPEAKER_01: And if your only copy of important client information is in a cloud service, you need to understand your recovery options.
• 21:02
  SPEAKER_01: For a law firm, the question isn't merely whether Microsoft is likely to lose your documents.
• 21:08
  SPEAKER_01: It's whether your firm could even continue operating if you temporarily lost access to them.
• 21:14
  SPEAKER_01: Could you meet tomorrow's filing deadline?
• 21:17
  SPEAKER_01: Could you retrieve a client's records?
• 21:19
  SPEAKER_01: Could you access your calendar?
• 21:22
  SPEAKER_01: Those are business continuity questions and they're part of cybersecurity.
• 21:27
  SPEAKER_01: I want to leave you with an observation.
• 21:30
  SPEAKER_01: Artificial intelligence creates some new security risks, but it also makes old security problems more consequential.
• 21:39
  SPEAKER_01: Before AI, an employee with overly broad access to SharePoint might never discover a confidential document buried in an unrelated client folder.
• 21:51
  SPEAKER_01: Now, depending on the AI system, that employee may be able to ask a question and have relevant information surfaced almost immediately.
• 22:01
  SPEAKER_01: Before AI, connecting an outside application to your Microsoft's account might have seemed like a relatively minor administrative decision.
• 22:10
  SPEAKER_01: Now, that application might be capable of reading, analyzing, and processing large volumes of client information.
• 22:20
  SPEAKER_01: And before AI, lawyers could sometimes get away with having a fairly casual understanding of their cloud permissions, but those days are gone.
• 22:32
  SPEAKER_01: The more powerful our AI tools become, the more important our existing security decisions become.
• 22:39
  SPEAKER_01: It's a paradox.
• 22:41
  SPEAKER_01: AI can make your practice more efficient, but it can also magnify the consequences of permissions and practices that were never particularly secure in the first place.
• 22:53
  SPEAKER_01: So, how secure is Microsoft?
• 22:57
  SPEAKER_01: I think the answer is very similar to the answer we reached in our Google episode.
• 23:01
  SPEAKER_01: Microsoft provides a remarkably sophisticated environment for protecting information.
• 23:08
  SPEAKER_01: And for many small law firms, properly configured Microsoft 365 services can provide a level of security that would have been difficult and expensive to achieve independently.
• 23:21
  SPEAKER_01: But purchasing Microsoft 365 does not automatically make your law firm secure.
• 23:28
  SPEAKER_01: And connecting Copilot or another AI application doesn't automatically make your use of AI safe.
• 23:35
  SPEAKER_01: You still have to understand who can access your information.
• 23:38
  SPEAKER_01: You still have to understand which applications you've authorized.
• 23:42
  SPEAKER_01: And forgive me for being as preachy as I've been, but you still have to exercise judgment about what information you share.
• 23:51
  SPEAKER_01: Remember the three-legged stools, Microsoft, your IT service, and you.
• 23:57
  SPEAKER_01: All three legs have to do their jobs.
• 24:01
  SPEAKER_01: We've prepared a companion Microsoft 365 security checklist with illustrations showing where to find some of the most important settings we've discussed.
• 24:11
  SPEAKER_01: You'll find it in the show notes along with links to Microsoft's own security documentation.
• 24:17
  SPEAKER_01: And if you're a Google Workspace user, be sure to listen to our companion episode, AI Builds, How Secure is Google.
• 24:25
  SPEAKER_01: I'm Ron Trescher.
• 24:26
  SPEAKER_01: Thanks for listening to AI Tools for Practicing Lawyers.
• 24:43
  SPEAKER_00: Right now.