Big banks are taking steps to defend themselves against cyberattacks, but regulators and policymakers want to see more progress.