Employers do have some level of responsibility for cybersecurity, despite a recent court ruling to the contrary. But there are steps they can take to avoid such risk in the first place.