Software patching must work like car safety recalls, says US cyber boss
- Reference: 1652457609
- News link: https://www.theregister.co.uk/2022/05/13/us_cyber_director_patching/
- Source link:
Speaking to The Register at the Black Hat Asia conference in Singapore on Friday, Inglis said that when a faulty component in a car needs to be replaced, the manufacturer who chose that component takes responsibility for securing safe parts and arranging their installation. He contrasted that arrangement with the fix for the [1]Log4j bug , which required users to seek assistance from both vendors that used the open-source logging code and source software from the Log4j project itself.
Inglis wants vendors to take responsibility for their choices so that addressing security issues is easier and users' systems – and the US – can achieve better resilience with less effort.
[2]
The director said such a change is the sort of thing he considers a necessary regulatory requirement for the digital age because to date some sources of problems have evaded responsibility or the costs of their errors.
[3]
[4]
The Biden administration has already shown its intention to increase technology regulation with initiatives such as the [5]Executive Order aimed at modernizing national defenses in the wake of attacks on SolarWinds, Microsoft Exchange, and the incident that closed the Colonial Pipeline. Another possible action has seen the SEC [6]float shorter compulsory reporting windows for public companies hit by infosec incidents, as well as periodic market updates on security efforts.
Inglis told The Register more regulation is coming, and while he wants watchdogs to have the "lightest possible touch," he also hopes to impose a "capital cost" on businesses to ensure they invest to improve their capabilities.
[7]Ex-NSA bigwig Chris Inglis appointed America's national cyber director by Senate
[8]US State Department opens cybersecurity policy bureau
[9]Log4j RCE: Emergency patch issued to plug critical auth-free code execution hole in widely used logging utility
[10]Looks like NSA now stands for Not Selecting Azure: US spy agency picks AWS over Microsoft
The director could offer no time frame for the delivery of new regulations, saying the administration is considering the needs of many industries.
One activity he wants to see more of is collaboration between government and the private sector, and more collaboration among agencies.
[11]
Inglis feels such efforts are essential because no entity knows or understands everything it needs to improve its information security. The director described collaborations in which entities each bring their own view of a situation to the table, and each gains the fuller view needed to tackle problems only after sharing information.
"We often overestimate what a government would know, or underestimate what the private sector knows," he told the conference.
He instead hopes organizations can share "a degree of professional intimacy such that we can discover things together that no one of us can do alone… so we discover something no one could have discovered alone."
[12]
National security agencies in the UK and Israel do this well, he said. And the US's efforts are improving thanks to the work of the Joint Cyber Defense Collaborative run by the Cybersecurity and Infrastructure Security Agency.
"The concept is beginning to work," he said. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2021/12/10/log4j_remote_code_execution_vuln_patch_issued/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yn7VA8mjUOQSTQ57RbNqxwAAAAM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yn7VA8mjUOQSTQ57RbNqxwAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yn7VA8mjUOQSTQ57RbNqxwAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.whitehouse.gov/briefing-room/statements-releases/2021/05/12/fact-sheet-president-signs-executive-order-charting-new-course-to-improve-the-nations-cybersecurity-and-protect-federal-government-networks/
[6] https://www.theregister.com/2022/03/09/sec_cyberattack_disclosure/
[7] https://www.theregister.com/2021/06/21/in_brief_security/
[8] https://www.theregister.com/2022/04/05/us_cybersecurity_cdp/
[9] https://www.theregister.com/2021/12/10/log4j_remote_code_execution_vuln_patch_issued/
[10] https://www.theregister.com/2021/08/11/nsa_aws_ms/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yn7VA8mjUOQSTQ57RbNqxwAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yn7VA8mjUOQSTQ57RbNqxwAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Re: An interesting viewpoint from Mr Inglis
"If the automobile had followed the same development cycle as the computer, a Rolls-Royce would today cost $100, get a million miles per gallon, and explode once a year, killing everyone inside." - Robert X. Cringely
Re: An interesting viewpoint from Mr Inglis
1, It's a rat's nest. Logically it is the authors responsibility to know what they are using in their project, but if a dependency depends on something they depends on something... It's a mess. Plus it is also a moving target, an update might completely change how something works under the hood, and it won't be noticed as long as it works the same way.
Personally, I think a coder ought to damn well know what their code is actually doing and using before inflicting it upon the world, but I don't envy them sorting out that mess. But see point 4.
2, If the repository wants to kill itself stone dead, sure. But do note the number of buffer overruns and parse failures and such in commercial closed source software. Let's see the unit test results for those, eh?
3, Absolutely not. Just because an author has given up on maintaining something does not automatically mean it is broken or has no value or purpose. To require people to remove unsupported stuff risks slaughtering a good point about open source (that being that the source is available should you want to tinker).
It also risks important consequences if an author decides to cease supporting something and removes it, immediately buggering up everything that depended upon it.
4, Ideally, responsibility should fall on the author to be aware of what his code is using. However, if one wishes to have programmers be held to the same standards and liabilities as car manufacturers, then I'm quite certain that one will be happy to pay programmers the same as people who design cars, and also perfectly willing to pay the same price for new software as for a new car. And no free updates, you have to buy each new version.
Because all that testing and design and crash test dummies? That's expense after expense. Not even remotely in the same category as this one guy in Montana that maintains something important in his spare time, for free.
Of course, all those whingers are fully able to obtain the source and contribute. Might be more useful than dreaming up ridiculous laws, but then, doing so requires mental acuity and competence. Proposing crap laws is something that any idiot could scribble on a napkin while on an expensive taxpayer funded working lunch.
Re: An interesting viewpoint from Mr Inglis
Open Source doesn't have much of a defined process to address this and it needs one.
However, I think that some of your questions are questionable at this time .
I would suggest a more gradual approach. For example, create a repository of abadonware, starting with authors who can no longer be reached via their contact information or who, once reached, state that they've abandoned the project. Then ask the community whether anyone is willing to take responsibility for them.
At least then you have a baseline to start with.
Software patching must work like car safety recalls, says US cyber boss.
Does he mean in the way a significant number fail to get recalled?
Re: Software patching must work like car safety recalls, says US cyber boss.
Would be nice if I could get updates for my car. Entertainment system has bugs that really could do with fixing.
An interesting viewpoint from Mr Inglis
Interesting, only because he seems not to understand the existence of Open Source and its implications.
In particular, as we've seen recently, there seems to be significant amounts of abandonware in popular shareware repositories and, worse, it is linked in as required component(s) of packages supported by other, unrelated, developers. It would be nice to know if Mr Inglis even knows that this sort of linkage exists and just who, if anybody, does he think should bear the legal responsibility for fixing buggy abandonware in such a calling sequence.
Seems to me there are four main questions that need answers:
1) what responsibility should the shareware repository owner have for providing tools that allow an author to determine who wrote shareware that his code depends on?
2) Should they refuse to accept code that's not fully documented and accompanied by a properly maintained set of unit tests with enough coverage to fully validate the shareware's operation with valid, invalid and out-of-range inputs?
3) should the abandonware author be legally responsible for removing code that they've decided not to support any longer? Who inherits this responsibility if the author dies?
4) What liability should fall on a shareware author whose product depends on buggy code written by a 3rd party and that may or may not be maintained?