Recommendations which could have stopped the WannaCry ransomware attack were ignored, a report says.