Proportional response to cyber attacks by foreign governments remains an unclear challenge

How vulnerable is American infrastructure to the threat of a cyber attack? And what sort of response is proportional?