3 security takeaways from the IRS Littlejohn data breach