Hi folks,
Two economists are walking down the street when a Ferrari passes them. The first economist says to the second “I always wanted one of those” to which the second replies “obviously not.”
Hilarious, right?
Well, it’s (maybe) chuckle-worthy if you’re familiar with the concept of revealed preference, a theory promoted by American economist Paul Samuelson in the mid-20th century. It says that consumer preferences are best evaluated by examining their purchases. There’s all sorts of math and caveats associated with the theory, but that’s the essence of the joke – if the first economist actually wanted a Ferrari, he’d have one.
And while the theory may not have launched many comedic careers, I think there’s a lot of applicability outside economics. Cybersecurity gets a lot of attention and talk these days – from the public, the regulators, agency leadership, the Hill… But it’s hard to discern how that attention and talk translates into actual priorities. When the chairman and ranking member of the House Oversight and Government Reform Committee say cybersecurity is a “top priority”, what does that really mean?
I suggest following your inner economist – look for the investments in cybersecurity. Do those investments indicate that it’s an actual priority or does it indicate that it’s an afterthought? Has the government/agency/organization not only made monetary investments, but also assigned the best people to the task, given them the support they need, and championed progress? Those resource investments will tell you exactly how much of a priority it is. It’s the economics version of “actions speak louder than words.”
Rex