Government ‘doesn’t know how vulnerable its ancient IT systems are to cyber attack,’ report finds