Officials sound the cyberattack alarm, but tend to leave business to fend for itself. Time for less talk and more deeds