Large law firms should assume that their systems have been compromised by hackers. Whether the danger is state espionage (e.g. Potash hacking of Bay St.), "Anonymous" or cybercriminals in California, firms are either currently being exploited or about to be.
Obviously guarding the front line (i.e. lawyer/assistant computers) is important but generally front line computers aren't the real target. Often the targets of hackers are wire and ACH transfer systems (viz. payroll).
The approach firms ought to take is "Defence in Depth": guard the places where money can be transferred from the firm. Firms should focus their IT policies and spending on guarding access to wire transfers and payroll systems. Using this approach can also minimize the need for draconian IT policies for lawyers that slow down their work (re: less money for the firm).
How can you protect your systems? One excellent technique, using air gapped systems, was covered in a previous post on this blog.
Is there a way you can rate limit access to client files? Many firms have systems like eDocs or network drives with all client documents. Can you restrict access? Can you "throttle" access so if you're compromised hackers can download every client file?