Critical infrastructure refers to physical and digital assets that are crucial for national security, economy, public health, or safety. It can be government or privately owned and includes not only power plants or electricity but also monetary systems. 

Cyber attacks on critical infrastructure have become a preferred target due to their significant impact, with examples including attacks on Ukraine's power grid (2015), Kansas's nuclear plant (2018), the SWIFT network, and Colonial Pipeline. 

These attacks may be motivated by various factors such as testing capabilities, financial gains, data theft, remote access, or service disruption. Perpetrators could be nation-states, cybercriminals, or hacktivists. 

Securing critical infrastructure, which includes industrial control systems (ICS) like SCADA, is crucial due to the potential for wide-scale compromise in vital systems such as transportation, oil and gas, electricity, water, and wastewater. 

Interdependencies between infrastructure sectors mean that a single failure can have a negative impact on multiple sectors. The financial implications of cyberattacks on ICS are significant, with potential costs of downtime ranging from $5,000 to $10,000 per minute. 

Cybercriminals and nation-states can extract substantial ransoms and demonstrate their cyberwarfare capabilities. For example, the Colonial Pipeline and JBS USA Holdings Inc. attacks resulted in $15 million in paid ransom. Attackers are increasingly targeting critical infrastructure and investing in improving their capabilities to compromise these organizations. 

Several types of attacks are commonly used against critical infrastructure, including distributed denial-of-service (DDoS) attacks, ransomware attacks through spear phishing, vulnerability exploitation, and supply chain attacks. 

Etay Maor noted that some of these techniques are particularly challenging to prevent as they target humans rather than technologies. To protect critical infrastructure, it's important to use effective and streamlined cybersecurity measures, rather than relying solely on numerous security products which can create friction and inefficiencies. 

The Cybersecurity and Infrastructure Security Agency (CISA) plays a crucial role in the US by providing support and assistance to critical infrastructure sectors. They coordinate cyber incident information, secure important domains, assist in protecting critical infrastructure, and offer cybersecurity education and training through programs like the Cybersecurity Advisor Program. This includes evaluating risks, promoting best practices, raising awareness, and providing incident support and lessons learned.