Reporting cyber attacks should be "a legal requirement"