If cloud-based services were regulated critical infrastructure like your average airport, the TSA would have shuttered many of them long before COVID-19 came along. With billions of people confined to their homes, the concept of “critical infrastructure” needs to be extended. In most web services and applications, runtime security is lacking and often nonexistent, as it can take months to implement. Once attackers get in, they can remain undetected for months. In the real world, if I steal the passport of an 87-year-old grandmother from Kansas, a TSA agent is probably going to notice.”]