Today’s columnist, Ciaran Martin of Oxford University, says the Colonial Pipeline attack showed the vulnerability of critical infrastructure. Martin argues that security people know we have to fix a broken system struggling with expansive vendor promises and corporate managers who can’t talk to tech people. Start by asking the right questions.