Password hygiene and phishing-resistant second factors still stop the majority of account takeovers
Alex Stamos, then Facebook's chief security officer, told the original interviewer that a password manager plus two-factor authentication covered the vast majority of user risk. That assessment holds in 2026. Credential stuffing and phishing remain the dominant paths into law firm and healthcare systems. A password manager that generates unique high-entropy secrets for every service eliminates reuse risk. The second factor should be phishing-resistant: a hardware security key or a passkey backed by device biometrics. SMS codes and authenticator apps are better than nothing but they can be phished or intercepted. We configure passkey enrollment as a default step in every onboarding because it removes the human decision from the loop. Comparison framing helps here: a hardware key costs roughly the same as a single hour of incident response but prevents entire classes of credential theft.
New hardware arrives with supply-chain risk baked in
The 2016 piece highlighted Superfish adware on Lenovo laptops and the FREAK TLS downgrade attack. Those specific incidents are history. The pattern persists. Devices ship with pre-installed management agents, browser extensions, and firmware components that expand the attack surface before the user logs in. A modern procurement policy treats every new endpoint as untrusted until it passes a clean-image rebuild or at minimum a verified inventory of running services. We recommend a standardized gold image for firm-issued hardware and a mobile device management profile that enforces encryption, automatic updates, and application allow-listing before the device touches client data. The contrast with bring-your-own-device policies is stark: unmanaged endpoints cannot meet the confidentiality obligations of a law firm or a healthcare practice.
Zero bugs is not a realistic target; zero-trust architecture is
Parisa Tabriz compared information security to medicine: an art and science where defenders must close every flaw while attackers need only one. Lillian Ablon of RAND added that the goal is making attacks expensive rather than impossible. In 2026 the industry has codified this as zero trust: never trust, always verify, enforce least privilege, assume breach. Network segmentation, continuous authentication, device health attestation, and micro-perimeters around sensitive data stores replace the old castle-and-moat model. For a law firm this means the document management system authenticates every request regardless of network location, and the electronic health record system logs every access with immutable audit trails. The shift from VPN to identity-aware proxy illustrates the change: the proxy evaluates device posture and user context on every request, while the VPN grants broad network access once authenticated.
HTTPS is no longer optional; it is the baseline
Peter Eckersley of the Electronic Frontier Foundation argued that every site needs HTTPS because unencrypted traffic exposes reading habits, form data, and injection opportunities. Today HTTPS is universal thanks to Let's Encrypt and automated certificate management. The remaining gaps are mixed content, misconfigured headers, and certificate transparency monitoring. We scan every client domain for HSTS preload eligibility, secure cookie flags, and content security policies that block inline scripts. A site that serves any resource over plaintext fails our baseline audit. The operational cost of maintaining HTTPS has dropped to near zero, so the only reason to skip it is inertia.
Cloud services shift risk; they do not eliminate it
Leigh Honeywell used an apartment-building metaphor: cloud providers watch logs at scale, detecting credential stuffing and mass exploitation automatically, but targeted attacks hide in the noise. The shared-responsibility model means the provider secures the infrastructure while the customer secures identity, data classification, and configuration. Misconfigured storage buckets, over-permissioned service accounts, and unmonitored API keys cause more breaches than hypervisor escapes. We implement cloud security posture management that continuously evaluates identity policies, encryption defaults, and network exposure against the firm's data classification schema. The decision between self-hosted and cloud-hosted email, for example, should weigh the firm's ability to patch Exchange servers against the provider's ability to detect anomalous sign-ins across millions of mailboxes.
Emerging threats require updated controls
The 2016 experts did not contemplate prompt injection against AI assistants, training-data extraction, or model-weight theft. Practices that embed large language models into client-facing workflows must treat model inputs and outputs as sensitive data. We apply data loss prevention rules to AI chat interfaces, enforce zero-retention APIs where available, and log every model interaction for audit. Supply-chain attacks on open-source dependencies, exemplified by the SolarWinds and Log4j campaigns, demand a software bill of materials for every custom application and automated vulnerability scanning in the build pipeline. The distinction between a library vulnerability and a malicious package matters less than the ability to detect and remediate either within hours.
Practical next steps for your practice
Deploy a password manager with passkey support across all staff. Enforce unique credentials for every service. Require hardware security keys or device-bound passkeys for remote access, email, and any system holding protected health information or privileged client data. Rebuild endpoint images from a known-good baseline. Remove bloatware, disable unused services, and enroll devices in mobile device management before first use. Adopt zero-trust network access for internal applications. Replace VPNs with identity-aware proxies that evaluate device posture on every request. Enable HSTS preload, secure headers, and certificate transparency monitoring on every domain. Automate certificate renewal. Map cloud identity and data flows. Apply least-privilege roles, enable cloud trail logging, and alert on anomalous access patterns. Generate a software bill of materials for custom code. Integrate dependency scanning into continuous integration. Monitor for malicious package publications. Extend data governance to AI interfaces. Classify prompts and completions. Apply retention and access controls consistent with your highest data tier.
Security is not a checklist you complete once. It is a continuous measurement loop: assess, harden, monitor, repeat. We run that loop for our clients every night.