Should vendors be liable for security flaws in software?

Abstract

Integrating security into applications is an obvious thing, especially since most software bugs are usually the result of small errors in the code or oversights in the requirements. However, very few people have publicly asked the question: should the vendors who create software containing security holes be held liable for their oversights? With the National Security Agency, along with the SANS Institute and MITRE, highlighting the urgent need for a solution with their list of the top 25 most dangerous programming errors, companies and vendors need to pay more attention. 1 Organisations need to start asking more questions about the security of commercial off the shelf software (COTS) and the custom applications that are developed specifically for them.