The US is expected to publish its long-awaited cybersecurity strategy before the end of the year. Here’s what it should do.