He's a CEO. His job is to ask others to find him the experts needed and manage them. He doesn't need to know any actual security engineering.

He needs to know the basics. How does he know someone is a real expert?

Well then, perhaps there should be minimum requirements to become CEO of a large corporation in regulated areas like pipelines? If the alternative is large harm to the public, this seems like a no-brainer to me for future legislation.

So should the president of the United States be an expert on tactical jet engines? And also have a PHD in economics? And also be an expert in immunology? And power plant operations? How about the national airspace system?

People are quick to conclude that Colonial’s security was “bad.” But do we know that to be true? A sophisticated, potentially state-sponsored organization initiated this attack. The best security in the world is not 100% secure. It might be wise to get the facts before rushing to judgement.

It’s probably cleaner and easier to run this if the spooks set up a bureau of cyber security standards and fine strategically important companies for non-compliance. The gov can do security audits on these corps.