I good start would be to write security critical software right the first time and not require frequent updates if at all. Every time an update happens it impos

I good start would be to write security critical software right the first time and not require frequent updates if at all. Every time an update happens it imposes a time cost and security risk on users. No other engineering discipline has the concept of updates to an in use product. When Toyota sells you a car if it has a "bug" in a control arm that results in it breaking and you losing control on the highway there is no software update. There is an NHTSA investigation and a recall.