Government IT security 'worryingly poor'