A great analogy and set of observations about board responses to cyber risk management.