{"id":46629,"date":"2022-05-13T16:00:09","date_gmt":"2022-05-13T16:00:09","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/software-patching-must-work-like-car-safety-recalls-says-us-cyber-boss\/"},"modified":"2022-05-13T16:00:09","modified_gmt":"2022-05-13T16:00:09","slug":"software-patching-must-work-like-car-safety-recalls-says-us-cyber-boss","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/software-patching-must-work-like-car-safety-recalls-says-us-cyber-boss\/","title":{"rendered":"Software patching must work like car safety recalls, says US cyber boss"},"content":{"rendered":"

Black Hat Asia<\/span> Software made unsafe by dependencies should be fixed without users needing to interact with the source of the problem, according to US National Cyber Director Chris Inglis, who serves in the Executive Office of the President.<\/p>\n

Speaking to The Register<\/i> at the Black Hat Asia conference in Singapore on Friday, Inglis said that when a faulty component in a car needs to be replaced, the manufacturer who chose that component takes responsibility for securing safe parts and arranging their installation. He contrasted that arrangement with the fix for the Log4j bug<\/a>, which required users to seek assistance from both vendors that used the open-source logging code and source software from the Log4j project itself.<\/p>\n

Inglis wants vendors to take responsibility for their choices so that addressing security issues is easier and users’ systems \u2013 and the US \u2013 can achieve better resilience with less effort.<\/p>\n