  Academia, homeland security, defense, and media have accepted the perception
that critical infrastructure in a future cyber war cyber conflict is the main
gateway for a massive cyber assault on the U.S. The question is not if the
assumption is correct or not, the question is instead of how did we arrive at
that assumption. The cyber paradigm considers critical infrastructure the
primary attack vector for future cyber conflicts. The national vulnerability
embedded in critical infrastructure is given a position in the cyber discourse
as close to an unquestionable truth as a natural law.
  The American reaction to Sept. 11, and any attack on U.S. soil, hint to an
adversary that attacking critical infrastructure to create hardship for the
population could work contrary to the intended softening of the will to resist
foreign influence. It is more likely that attacks that affect the general
population instead strengthen the will to resist and fight, similar to the
British reaction to the German bombing campaign Blitzen in 1940. We cannot rule
out attacks that affect the general population, but there are not enough
adversarial offensive capabilities to attack all 16 critical infrastructure
sectors and gain strategic momentum. An adversary has limited cyberattack
capabilities and needs to prioritize cyber targets that are aligned with the
overall strategy. Logically, an adversary will focus their OCO on operations
that has national security implications and support their military operations
by denying, degrading, and confusing the U.S. information environment and U.S.
cyber assets.
