What law firms can learn from the National Cyber Security Centre (part of GCHQ)