Both agree on this much: The U.S. needs to improve its defenses, especially in areas like the power grid. McGraw said those who say the financial system is more vulnerable than the power grid have it backward. "The finance guys have much better defenses than the power grid," he said.

Philpott says the security of energy facilities is "not up to standard. A lot of the things we depend on aren't built very well," he said. "They fall down under the simplest of attacks."

McGraw said the best way to protect critical infrastructure against cyberattack is to "build things that aren't broken."

Yes, it's impossible to build devices that are completely invulnerable, he said, but it is possible to build them so they are very difficult to attack. "And if the cost [of an attack] is too high, the bad guys will go elsewhere," McGraw said.

Philpott agrees. "Don't make it low-hanging fruit," he said.