What to do about inherent security flaws in critical infrastructure?