How the government should regulate cybersecurity