But the real virus threat, according to Mr. Mattson of Weil Gotshal, can be surprisingly low-tech. It is not the Internet that poses the greatest danger, but word processing documents that come from clients and co-counsel. Viruses, he said, can be imbedded in a Microsoft Word macro or document template. In fact, it is the employee at the desktop who poses, often unwittingly, the greatest security risk. Professor Spivak cited one study that found that 80 percent of computer break-ins did not originate on the Internet, but on the local area network.
Someone walks away from their desk and leaves the machine on.
People don't lock the server room. One associate at a large international law firm recalled finding a system password written on a sheet of paper taped to a remote-access terminal. Disgruntled employees, noted a systems administrator at another firm, are a major source of concern. Mr. Useloff, of Micro Modeling Associates, recommends that firms quickly revoke the access and passwords of dismissed employees. Once they are past the firewall, everything is available.