The Biden administration is concerned about software development that is overly reliant on post-sale bug patches, which sometimes means the government is sold software with vulnerabilities.
“These are defects and vulnerabilities that developers are accepting as the norm, with the expectation that they can patch later,” Anne Neuberger, the Deputy Assistant to the President and Deputy National Security Advisor for Cyber and Emerging Technology on the National Security Council, said today at RSAC. “Or perhaps developers decide to ship software with defects and vulnerabilities they decide to ignore if they the vendor deem those defects and vulnerabilities are not sufficiently serious to merit fixing.
“That’s not acceptable,” she said in a pre-recorded video at the all-virtual security conference.
A possible solution, according to Neuberger, is “requiring government vendors to build software in a secure development environment.” This could mean requiring companies to use security measures such as using strong authentication, encryption, among other things. Neuberger pointed out that some vendors already do this, and called for more transparency from companies so government agencies and consumers can make better choices when they shop for software.
Despite those criticisms, Neuberger emphasized a need to reaffirm a partnership between the US government and the cybersecurity industry. “The stakes couldn’t be higher,” she said.
To that end, a recent executive order signed by President Biden “creates a pilot program to create an ‘energy star’ type of label so the government – and the public at large – can quickly determine whether software was developed securely,” the White House says.
In her remarks, Neuberger also stressed that the Biden administration is taking cybersecurity seriously and working internationally to combat security threats around the world. Specifically, the administration is making ransomware a top priority.
“Transnational criminals are most often the perpetrators,” and these threats are increasing in sophistication, she said. An easy example is Colonial Pipeline, which was hit by a ransomware attack that led to a gas shortage, even after the ransom was paid.
Neuberger said investment in secure infrastructure is a primary concern for the administration, as is protecting the supply chain for vital components, like encouraging more domestic production of semiconductors. In this context, Neuberger cited the American Jobs Plan, an infrastructure proposal backed by the White House, as a key part of that investment.
When it comes to investment, Neuberger also touched on quantum computing. This emerging field shows great promise to move technology forward, but Neuberger also pointed out that it could “fundamentally disrupt” cybersecurity and create new vectors of attack. While there have been bold claims about quantum computing breakthroughs in recent years, some experts remain skeptical that these machines will yield the predicted positive and negative outcomes.
