Government 'timid and slow' on cybersecurity