I'm not encouraged with state of software security. A few big vendors have made security a requirement in the development life cycle, but most won't say whether they have or not. Security requires a big investment as well as executive buy-in; it is not trivial.

Microsoft is making a big effort to get Windows developer to follows its Security Development Lifecycle (it even created a Visual Studio template), but buy-in has been limited to a few large customers. Likewise, efforts to teach security at universities have fallen flat. An NSA program that provided incentives, including scholarships and grants for students, achieved limited success against university culture.

Aside from greater security for infrastructure (firewalls, anti-virus programs, patching), I've seen little progress outside of a handful of companies. Progress has come too slowly, and infrastructure and people's personally identifiable information are at risk. The only thing that has been helpful to secure PII is a combination of bad press and government statutes.

That is why I thought that a bill proposed in the UK House of Lords in 2007 a good idea: It suggested that a liability framework be established to prevent software makers from dumping risks onto customers. There has been no economic incentive to do security right.

The Chevrolet Corvair was recalled after consumer advocates claimed that it was unsafe at any speed; there was a clear commercial incentive for General Motors to manufacture safe products. Liability might be the right kind of medicine for the software industry.

Companies that follow SDL-like processes would not be held negligent. Making software secure is difficult work, and no one knows what attack vectors will appear in the future. However, companies that do not invest in security should be held liable.

President Obama's decision to make cyber security a national priority has changed my mind for the time being. I'm willing to withhold judgment to allow his plan to work. Public/private partnerships have produced excellent results in the past, and the industry might do what is necessary to forestall regulation. Companies should not forget that this is a national priority.

The stakes are high and my patience isn’t infinite. I'd advocate regulation if progress is not significant by the President's second term (or at the start of his successor's term). Remaking how software is made is a huge task, but then again so was the Apollo program.