What are the biggest information security concerns for a law firm?

Endpoint security is definitly a risk I would determine high priority. Even if all employees are loyal, screened etc. they will always be open to blackmail/extortion (everyone has a weak point) and may in that way be forced to take data on a USB device with him/her. And the reconstruction on that from an analytical point of view is damn hard. 
Email is a security issue as well – of course – but I guess the organization will have some way of documenting and loggin which employee sends which email at what time and monitors correspondence for security reasons. 
The WiFi topic is something I will complete leave out here at this point, agreed?  
Let’s come to the most critical point: the LAN and WAN and find a short solution… DO NOT! have the server that has the confidential/classified info connected to the WAN. It will be accessible from the local network ONLY. And even if you have it on a VM.