The U.S. government has made significant strides in reducing direct cyberattack risks. Yet more needs to be done to prevent supply chain attacks.