Here is what I posted on linkedin.com last week:

700 billion dollar information security bailout?

The parallels between the financial crisis the US currently finds itself in and the state of information security is uncanny. I could run down the list and provide a line by line comparison of the failures in both areas. For example:

1). Failed regulatory oversight (SOXs, HIPAA, GLBA)
2). Failed self regulation (PCI, ISO)
3). Failure for consumers to manage risk (education, awareness)
4). Failure for companies to manage risk (risk analysis, awareness)
5). Failure for the current bailout to protect the consumer (no need to explain)
6). Reaction only when a threat is upon us (building security in vs slap on)

In both situations, the consumer is talked about...held up as the main focus, but the actions do not seem to support protecting them. Look closely at our privacy laws, security laws and identity theft laws and you can see the lack of any real consumer based legal causes of actions that are available.

Do you see any opportunity to leverage the current crisis to finally focus on the consumer privacy and security rights? At a time when the government is calling upon greater oversight and regulatory authority, should the security industry be lobbying to get the consumer protections front and center?