The government and private companies involved in the UK's critical infrastructure both come under fire for neither understanding nor being properly prepared for the threats posed by cyber-crime. A national cyber-security culture needs to be developed