Joe Sullivan: CEOs must be held accountable for security too