National security experts and policy makers say the U.S. needs to act now to raise the cost of doing business for state-backed attackers.