How the biggest cyber security disasters could have been avoided