Lack of CFO's involvement in cyber security proves costly for firms