The requirement is that the good guys collectively have more CPU power than any single attacker.
Discussion
Now it's even better: good guys must collectively have more *hashpower* (i.e. SHA256 ASICs) than any single attacker.
If you're AWS or Azure (or have control of a botnet), you can acquire an enormous amount of CPU power. Hashpower is much more scarce (and most of it is already spoken for).