Schools are swotting up on security yet still flunk recovery when cyberattacks strike