Debugging our Cyber-Security Policy Edward W. Felten Department of Computer Science Woodrow Wilson School of Public and International Affairs Center for Information Technology Policy Princeton University

Need a long-term approach.

Need to protect the average computer.

Software quality is the core problem.

Need to improve the ecosystem.

The market is not solving our problem.

Market failures: Lemons problem Negative externalities

Few places to invest

Action: Make necessary short-term investments.

Strategy: Attack the market failures.

Action: Foster broad information sharing.

Action: When purchasing, try to internalize externalities.

Action: Long-term investment in human capital.

Action: Give someone authority to force action.

Debugging our Cyber-Security Policy Edward W. Felten Department of Computer Science Woodrow Wilson School of Public and International Affairs Center for Information Technology Policy Princeton University