Consumers always question the estimates of damage. It's always $2.5bn or $3bn, but I always get emails asking where those figures come from. Where do they come from?
There are external organisations. You can argue about their methodologies, but they're consistent. They look at opportunity costs, productivity losses and, in some instances, real damages to machines. They look at how much network traffic was interrupted, how many people were affected, how many devices were affected. And then, here's your number.
I don't care if we like the methodology or not. One true thing is that the volume of the activity is increasing, the complexity of the activity is increasing, and therefore, the associated costs are increasing. It's on a trajectory we all need to be concerned about.
How about the government?
The issue of securing the government's infrastructure has gotten a lot of attention over the last couple years, certainly as a result of the National Cybersecurity document produced earlier this year. It said the government needs to serve as an example -- a role model -- for the private sector on how to secure an infrastructure. A lot more money has been allocated and applied to securing the government's infrastructure. But there is a long way between raising awareness in the government, getting buy-in from both sides of the house and getting programs implemented. We're not quite there yet.
What do you think of security professionals? There are a lot of mavericks and eccentrics. Does the culture of security experts need to be changed a bit?
I think that we need to create a culture of security. We've been able to change things in our country by reinforcing messages. Seat belts -- terrific example. When seat belts first came out, they were a pain in the ass. Everyone wanted to take them out of their car. Now, you don't even think about it. You get in your car and buckle up. Forest fires. Smokey Bear. Wonderful campaign.
Time and time again, when there was a societal threat, we used the power of the public broadcast system to raise the consciousness of the public, and I think that's where we are in this digital world. More and more of what we do will be connected, and more of what we do will depend on that connected infrastructure. We need to raise the awareness of individuals to the largest governments of the world that there are simple steps that they can take to be more secure.
