Paying ransom should be your last resort, cybersecurity expert says