Should best cybercrime defense include some offense?