Comment Focus on offensive capabilites is misguided (Score 5, Informative) 136
Ralph Langner (the guy who figured out Stuxnet was designed to attack Iran) has been critical of the US's policies of focusing on offensive capabilities while largely ignoring or grossly underfunding defensive capabilities. He wrote a op-ed in the NYT about this. Hereis his rebuttal to Obama's executive order on critical infrastructure cyber security.
One of the problems with cyber defensive security is that too many companies use "risk assessment", which is inappropriate for security concerns. This is because risk assessment assumes that you are aware of all possible vulnerabilities and what impact these vulnerabilities will have, which is impossible. It is too easy for companies to use a risk assessment model as an excuse for not spending any money on their security, because the costs of security show up on a balance sheet while the benefits do not.