How to get cyber security right