While these are thoughtful arguments, challenge 2 falls short. The common but flawed idea voiced by many is the need to “get ahead” of the bad actors. The reality is that security, and law enforcement, have been behind, or responsive, to the bad actors of the world since the first caveman raised a rock and forcibly took more meat from the hunt than otherwise entitled. Cyber security (or all security for that matter) is behind the bad actors and will continue to be but, and it is a big BUT, the information security community has been able to find ways to stop the piling on and have successfully mitigated billions in dollars in risks for our employers/customers.

The greater failure of information security (and maybe its too heavy handed to blame information security and not government and commercial leadership) is not in getting ahead of the bad actors but being part of the silent enabling population who through failure to adopt patching processes, spam filters, malware detection and eradication,... in other words a reasonable and robust information based security infrastructure, allow the repeated exploitation of themselves, their customers, and the larger cyber space. Not staying abreast of the bad actors is the larger problem. Getting ahead of the bad actors will occur and but realistically that is not where the large breaches and losses are occurring.

Crime is crime. Since that first caveman committed the first crime, all that’s changed is the weapon. In what universe has law enforcement gotten 'ahead' of the bad actors? Building bullet proof shields around bank tellers, installing cameras, hiring guards, using die packs,... all stopped previously identifiable methods of robbing banks. They did not 'get ahead' of the bank robbers. The robbers adapted with new techniques or went and robbed banks where these precautions had not been put in place. Why do we continually want to treat cyber crime as different?

Our national leadership, void since the beginning of this debate over three decades ago, needs to step up and address how to cajole, bribe, or mandate the deployment and implementation of EXISTING proven policies, technology, and processes to stop the bad guys. As that is put in place we should be looking at “what’s next” but lets fix the sucking chest wound before we address the high cholesterol of our patient.