Getting businesses to take security seriously

Over at the Armchair Generalist is a post about security chemical facilities. The DHS is requiring 7,000 facilities to improve the security of their chemical storage and manufacturing.

Having worked in computer security in the past, I know that most business don't take security seriously until after they have an incident. Even then it isn't all that important. The problem is that most people don't think about security when making purchasing decisions.

Since security failures often effect people other than the producer and consumer of a companies products. With the chemical facilities, it may impact many other people that don't have anything to do with the facility or their products.

The threat of lawsuits could convince some companies that they need to improve security, but as we've seen with the airlines and 9/11, the government is too willing to bailout companies with poor security when there is a terrorist attack.