Power engineers were responsible for keeping electricity flowing. A proposed cyber unit, staffed by outsiders,
would change their operations while leaving them accountable. They resisted.
A new national cyber agency brought me in as a foreign expert. After studying local arrangements and
interviewing sector professionals, I recommended keeping the engineers in charge, with cyber specialists
alongside them.
Within weeks, the sector accepted my recommendations. Engineers helped design and review the changes, removing
opposition and avoiding the cost of establishing and staffing a separate unit and duplicating systems.
New tools gave cyber specialists visibility across industrial control systems and IT: data they could
correlate, use to establish normal behaviour, and monitor for anomalies—a foundation for measuring performance
and deciding what to improve.
Related work on critical-infrastructure resilience →