Time is up. You have three years, 3 months, 3 weeks, to protect your Stuff. What do you do?

This session opens a two-hour discussion of how to reduce risk to critical infrastructure when a destructive attack seems close, with the focus on measures that work within months rather than years. Josh Corman frames the problem around recent disruptions in healthcare, water, food, energy and pipelines, and around government warnings about a state-linked campaign already present in US utilities. The central concern is the cascading effect of a destructive attack, not a ransom, and the talk stresses that many operators lack staff, budget and basic know-how to respond.

The middle portion covers the policy picture. A White House representative describes a national cyber strategy that is moving from voluntary guidance toward using existing regulatory authority. Topics include sector-by-sector risk identification, the CISA baseline performance goals and its list of bad practices, and efforts to identify systemically important entities. Healthcare serves as the main example: losing medical technology and staff raises mortality for time-sensitive care, and a hospital closing after a prolonged disruption is a lasting harm to its region.

The closing discussion turns to near-term actions. Suggested steps include removing unnecessary internet-facing services, fixing known exploited vulnerabilities first, eliminating default credentials, and keeping analog fallbacks such as manual procedures and water filtration. Audience questions covered workforce pipelines, accreditation bodies, federal grants and local tabletop exercises. The main takeaway is that much of near-term resilience comes from simplifying systems and building community capacity rather than adding new tools.