In some cases, we've seen spending on security and security planning increase. I believe security is getting better. It's going to take a while, but the intent of the senior executives is that they will put the resources they need in place over time. The government could be giving them more incentives to do so, but over time they have to do it or they won't survive. I don't think they have provided the necessary incentives yet, fundamentally because the government, like industry, sometimes confuses policy with security.
Security requires substantial architecture and hard dollars on capital assets.
Policy can be done more quickly. I don't think regulation will really do the trick because a regulation becomes dated almost as soon as it's printed. The knowledge base changes, the threat models change, technologies change, and regulation doesn't give an incentive for a long-term organic view of designing in security. Presidential Decision Directive 63 said the government should become a computer security role model for industry. I think the government is improving.