1. Debugging our Cyber-Security Policy Edward W. Felten Department of Computer Science Woodrow Wilson School of Public and International Affairs Center for Information Technology Policy Princeton University

2. Need a long-term approach.

3. Need to protect the average computer.

4. Software quality is the core problem.

5. Need to improve the ecosystem.

6. The market is not solving our problem.

7. Market failures: Lemons problem Negative externalities

8. Few places to invest

9. Action: Make necessary short-term investments.

10. Strategy: Attack the market failures.

11. Action: Foster broad information sharing.

12. Action: When purchasing, try to internalize externalities.

13. Action: Long-term investment in human capital.

14. Action: Give someone authority to force action.

15. Debugging our Cyber-Security Policy Edward W. Felten Department of Computer Science Woodrow Wilson School of Public and International Affairs Center for Information Technology Policy Princeton University