🎮 Play along. Answer before you scroll.
You are the attacker. You have a team, a budget, and one target: a country. You can only go after one thing. What do you choose?
🔵 Card A: Information 🟡 Card B: Money 🔴 Card C: The physical world
Most people answer fast. Steal data. Leak documents. Take down a bank's website. It is what the news has trained us to expect. Hold on to your answer. We will come back to it.
🃏 Three cards on the table
Every attack on a country comes down to three cards: information, money, or the physical world.
- 🔵 Information: citizens' records, government emails, sensitive documents.
- 🟡 Money: banks, payment systems, markets.
- 🔴 The physical world: power, water, food storage, transport.
The first two hurt, but they hurt on a screen. The third hurts somewhere you can touch.
📊 The scoreboard
Same three cards, three scales. Longer bar, more of it.
INFO MONEY PHYSICAL
Public notices fast ████░ █████ ██░░░
A backup can fix it ███░░ ████░ █░░░░
Built before security ██░░░ ██░░░ █████
🟠 Illustrative scores for discussion, not measurements. The pattern is the point: the physical card is the slow one to notice, the hard one to undo, and the old one.
🔀 Choose your path
Which card did you pick at the start? Jump to your path, then read the other two. Your answer says a lot about what you are protecting.
🔵 Path A: you picked Information
A data breach is a bad day with a clear shape. Someone notices, logs are pulled, passwords are reset, the press release goes out, and the organization starts recovering. It is expensive and painful, but the damage is mostly something you can measure and, to some degree, repair. Money can be refunded. Accounts can be frozen. Even leaked secrets lose value with time.
🔴 Path C: you picked the physical world
Picture the target: the temperature control of a grain silo. Nobody's data is stolen. No screen shows a ransom note. A few numbers shift slowly, and the grain stored there starts to spoil. By the time someone notices, the damage is already in the food, and you cannot restore it from a backup. A silo is not a database.
🚨 This is not hypothetical. Months ago, attackers tried to manipulate exactly this kind of system in our national silos. The goal was not to steal anything. It was to damage a strategic reserve. It was caught and contained. But think about how different the headline would have been if it had not.
🧠 What a smart attacker weighs
A rational attacker does not only ask "what hurts most?" They ask three questions:
- 👁️ How visible is it? Loud attacks get fast responses.
- ↩️ How reversible is it? An attack you can undo with a backup is a weaker weapon.
- 🚪 How easy is it to reach? Old systems with weak protection are cheaper targets.
Physical systems score uncomfortably well on all three: quiet, hard to undo, and often built before anyone thought about security.
💸 Why we defend the wrong card
Look at where the money goes. Security budgets follow headlines, and headlines follow data breaches. So we buy better email filters, bigger firewalls, and more training for the office. All of that is good. But the control system at the back of the plant, the one that has been running since before the company had a website, often has no budget, no owner, and no monitoring.
🍞 The bread test
For any system, ask what does it put on the table? The closer a system is to the table, the more careful its security needs to be.
reports ──► money ──► services ──► ESSENTIALS
(1) (2) (3) (4)
databases payments transport water · power
food · medicine
far from the table ◄────────────► at the table
If a database goes down, the answer is "reports." If a water treatment controller goes down, the answer is "water." If a silo controller goes wrong, the answer is "bread."
✏️ Your turn: pick three systems in your organization and finish the sentence: "If this goes wrong, what ends up missing from someone's table?"
🔇 "It hasn't happened to us" is not a plan
Most organizations that get hit were not careless. They were comfortable. For years nothing happened, so the quiet felt like safety. But for physical systems, quiet is exactly what the weakest controls produce: no alerts, no logs, no one watching. Silence is not proof that nothing is wrong. Sometimes it only proves that nobody is looking.
🔁 Flip the question
Now switch sides. If you wanted to protect a country, what would you pick? Not data or money first. Start by listing what people cannot live without for a week: electricity, clean water, food, medicine, communication. Then ask who controls each one, how old their systems are, and whether anyone is watching them at night. That list is your real critical infrastructure.
🧱 Where to begin
🏢 OFFICE NETWORK ──[ THE LINE ]── 🏭 PRODUCTION NETWORK
email · files watch it controllers · sensors
- 📝 Make the list. The systems whose failure leaves something real missing from the table.
- 🚧 Draw the line. Know where the office network ends and the production network begins.
- 🔭 Watch the line. Monitoring the boundary catches more than any perimeter tool.
- 🎭 Practice the bad day. A plan nobody has rehearsed is a plan on paper.
☕ Questions for Monday morning
- Which three systems, if they failed, would we hear about from customers before our own team?
- Who is allowed to connect to them from home, and when was that last reviewed?
- If our network went down right now, who knows how to run the plant by hand?
These take twenty minutes in a meeting, and they can change a budget.
✅ Check yourself
Tick what is true today. Count your ticks.
- We know which of our systems control something physical.
- Each one has a named owner.
- We know who can reach it from outside the building.
- It is monitored at night and on weekends.
- We have a written plan for running manually if it fails.
- We have practiced that plan.
🟢 5 to 6 ticks: covered. Keep rehearsing. 🟡 3 to 4 ticks: soon. Pick the missing one and fix it this month. 🔴 0 to 2 ticks: fix first. Start with the owner. Nothing else works without one.
🗳️ One last vote: did your answer at the start change? Tell me in the comments which card you picked, and which one you would protect first now.
The answer to the question is not a target. It is a map of what you need to protect first.