Securing critical infrastructure: the regulatory vs the practical