Law firms are one of the most targeted sectors in cybersecurity, and among the least defended