The Competitive Enterprise Institute just published Cybersecurity Finger-pointing: Regulation vs. Markets for Software Liability, Information Security, and Insurance, by Clyde Wayne Crews.

I have not yet read it, but I follow a heuristic that anything Wayne writes is well worth reading.