Despite the increasing number of cyber attacks, and the damage being done, many firms do not know where to start.