Boards need to brush up on cybersecurity governance, survey finds