Cyber protections for critical infrastructure must have a dual focus