Why You Should Rethink Your Cybersecurity Policy