Due Diligence Obligation of States and Cyber-attacks: A Loose Cannon?