Quantifying risk is an important aspect of information security; things such as the Trustwave Global Security Report and compliance numbers that are released ea

Quantifying risk is an important aspect of information security; things such as the Trustwave Global Security Report and compliance numbers that are released each year helps deal with providing an overarching picture of the infosec landscape. Transparent security, or at least your description of 'what security controls could be implemented that provide the maximum risk reduction for the minimum cost' is perhaps the very basis of the whole industry. Certainly not a solved problem, but many best practices may be implemented that aim to achieve this goal. For example, follow secure coding guidelines for developers, DMZ important services, airgap networks for confidential data, patch solution, firewalls/ACL's, etc. Information centric security is an interesting category that I think probably has the most room for growth out of the areas that you mentioned. Some things are simple -- store password hashes instead of plaintext, encrypt sensitive data whenever possible, implement rule of least privilege, etc. The great thing about information security, to me, is that the landscape is constantly shifting. Problems that the industry is facing today (APT, anyone?) are nothing like they were even a few years ago. I can't say that I have a definitive answer to your question (if I did, I'd be coding it myself ;), but my advice would be to pick one very specific area and focus on it. Look at Dan Kaminsky and DNS problems, for example. Good luck, and kudos for trying to improve things :) Oh -- one last thought before I go. Compliance (PCI, HIPAA, NERC) drives a lot of information security need. Creating a simple way to get compliance checks in order not only provides business to the infosec industry, but could relieve a major headache for organizations that need to be compliant.