US cybersecurity chief: Software makers shouldn't lawyer their way out of security responsibilities