Software patching must work like car safety recalls, says US cyber boss