How US companies can defend against cyberattacks from state actors