You need a way to generally enforce an appropriate effort to security. This seems extremely important. I don't see liability, after-the-fact-punishment, only wi

You need a way to generally enforce an appropriate effort to security. This seems extremely important. I don't see liability, after-the-fact-punishment, only with software vendors, being the way to achieve this. Numerous threads on HN lately have discussed the way that "connect everything to everything" approaches wind-up inherently insecure and a wide range of organizations have no incentive to stop them. Water systems have no need to connect to the Internet even indirectly and neither automobile remote start system but organization managing these things have no incentive to take this stuff seriously. This is what's called an "externality" and a difficult one. Externalities are generally best dealt with be direct regulation but security is a bit different externalities because defining best practicing isn't. I could imagine a "security institute", only focused on defense and independent enough to be trustworthy to most institutions. But I'm not all that optimistic such a thing could be created.