How Merck leveled up its cybersecurity strategy since the NotPetya cyberattack that led to a $1.4 billion dispute