Cyber-experts need to concentrate on reducing harm not technical proficiency, says Facebook security head