Should businesses or government do more to defend against cyber attacks?