How much of a concern is protecting critical infrastructure and how should organisations go about doing this pragmatically?