US cybersecurity agency: Security flaws are product defects

Jen Easterly, the head of the US cybersecurity agency, put it bluntly at Mandiant’s mWise conference: “The truth is: technology providers are the ones who create vulnerabilities in their products,” which “opens the door for bad guys,” reports British news site The Register.

Advertisement

TV streamers, streaming and smart home via AI from Google

Even calling security flaws “software vulnerabilities” is too mild and “actually obscures responsibility. We should call them ‘product defects,'” Register Quotes Head of the Cybersecurity and Infrastructure Security Agency (CISA). Easterly also complains that users are always told to install updates to their software quickly. “Why don’t we ask: why does software need patches so urgently? The truth is: we have to demand more from technology vendors!”

Ultimately, risky software is the backbone of America’s critical infrastructure. Easterly concludes: “We don’t have a cybersecurity problem, we have a software quality problem – we don’t need more security products, we need more secure products!”

Empty promises of more security

The head of CISA has long been promoting security by design and has also worked with other international security authorities German BSI – Secure by Design initiative launched in April 2023. In addition to information and tips It includes a request to make a promise (a pledge)Which the company owner can take voluntarily. That is Already done by more than 200 people From Microsoft, Google, Amazon, GitHub or GitLab, etc., but not from Apple.

These promises are not binding You will read eachYou find that most manufacturers primarily praise themselves and their commitment to safety.

(Who)