“Appalling.”

“Appalling.”  That's what former NSA technology boss Prescott Winter has to say about corporate IT security.  This isn't really news, nor is it surprising – as there's little actual incentive today for corporations to spend the money and effort on the problem.  The biggest problem is that our existing laws don't hold these companies liable for the damage a security breach causes.  Bruce Schneier has been writing about this for years, like this 10 year old post: “Liability changes everything”.  I haven't seen any serious proposal addressing this issue, though...