It might be critical, but infrastructure in the United States has remained stubbornly difficult to protect from cyber and physical attacks.