I see publications like this come out of CISA every so often, but they always follow a similar format: "security is a really big problem", "the industry is consistently failing to apply well-known solutions", "will you pretty please just get on top of this already?"
There is no regulatory body equivalent to the FTC or SEC or FDA for software, and it shows. Big software isn't magically more altruistic than big pharma or big agriculture or big finance. Given a choice between making huge amounts of money with very little overhead and raising overhead in order to protect consumers, they will consistently choose the former. It's high past time we have an agency with real teeth to regulate the software industry.
There is no regulatory body equivalent to the FTC or SEC or FDA for software, and it shows. Big software isn't magically more altruistic than big pharma or big agriculture or big finance. Given a choice between making huge amounts of money with very little overhead and raising overhead in order to protect consumers, they will consistently choose the former. It's high past time we have an agency with real teeth to regulate the software industry.