Information security systems are like umbrellas, says John Mallery: No matter how sturdy they are, somehow your feet always seem to get wet. And your 900-employee law firm can't afford any wet feet—or security breaches—on a network loaded with highly sensitive communications and data.

The problem is likely not the umbrella, says Mallery, a managing consultant of computer forensics at Springfield, Mo.-based accounting firm BKD LLP. "You can harden your systems with hardware and software," he says, "but is your staff trained to support it? More than anything, security is a people challenge."

Proof positive is your firm, which has made the necessary investment in a sophisticated firewall and an intrusion detection system (IDS)—software that sniffs out suspicious incoming network traffic. But despite that investment, your firm has experienced its share of viruses and at least one successful hacking attempt . . . that you know about, anyway.

Instead of looking outside, your six-month security-hardening project will shift the focus inside, with a heavy emphasis on staff training and stronger internal controls. Information-technology staff will take part in specialized training to help them better support and maintain security systems. I.T. staff and on-site consultants will also help educate the general staff on security concerns, and then back up that bound-to-be-forgotten training with internal systems that will do the job for them. That means, for example, timed logoffs for the partner who always leaves his computer on, and shutting down the Kazaa party in the law library, which unwittingly opens outward-bound file-sharing from within the network.

A small investment in additional hardware and software will be needed as you add the new security layer inside your network. In addition to erasing problems from within, this internal layer will also offer an extra level of protection in case anything does slip past your external firewall.

So let it rain; you're covered.

To see the details behind this planner,Download the PDFand see what it would cost your company to beef up its security.