One in a billion

ONE IN A BILLION: A BOY'S LIFE, A MEDICAL MYSTERY its an amazing story of early stage DNA sequencing technology's impact on a family; that story is wonderfully told, and the Milwaukee Journal Sentinel beat out WSJ, WaPo and other big boys with this story to win the Pulitzer. I recommend reading all three parts when you have time. 

There is one part that is very relevant to infosec, as the doctors search for a cause or cure to the mystery disease

"One of the problems is: Without a therapy, do you want a diagnosis?" asks Walter Gilbert, an emeritus professor at Harvard who shared the 1980 Nobel Prize in chemistry for developing a method of sequencing DNA.

"It's a cost issue. Will somebody pay for it? For insurance to pay, it's not enough that the patient wants it or the doctor wants it, but the insurance company has to agree that it's useful in some way."

The inter-related parts of testing, mechanisms and incentives are right out of Ross Anderson's Security Engineering framework

 

Often the challenges in dealing with security findings is not that we don't know how to fix something, its that there might not be a practical way to deploy a fix. Incentives (often economic) drive people's priorities to address policy matters, implement fixes and conduct additional testing, but its a balancing act to get the right allocation across each of these activities.