Auditor warns of cyber security flaws in government departments