Metrics, Economics, and Shared Risk at the National Scale

The more electronically interdependent we are the more risk we share. Daily we have to choose between default deny (safety) and default permit (freedom). If we prefer rational decision making, we will prefer that numbers—and, reflecting our sharing of risk, the Law of Large Numbers—drive our policy decisions at the national level. These numbers do not come from thin air or, if they do, they will merely contribute to the rising fraction of security practitioners who are charlatans. This talk is more challenge than prescription, thus to reflect the state of the art.