Cyber-security is a business issue, not an IT issue