What choices have to be made by whom to solve DDoS problem?

I mean who other than regulators. That is, I think that this is the last opportunity before heavy handed regulation that possibly throws out the baby with the bath water.