The Cybersecurity and Infrastructure Security Agency (CISA) announced its “Secure by Design Pledge,” a voluntary commitment by software manufacturers to work towards implementing several cybersecurity best practices. The Cybersecurity Coalition worked with CISA after initial release of the pledge and is happy the agency took feedback from industry.
The pledge focuses on manufacturers of enterprise software, e.g., on-premises software, cloud services, and software-as-a-service (SaaS). However, manufacturers of physical products -- e.g., IoT devices -- and consumer software are also welcome to sign. All signatories are expected to make progress toward goals in seven key areas:
- Multi-factor Authentication (MFA)
- Default Passwords
- Reducing Entire Classes of Vulnerability
- Security Patches
- Vulnerability Disclosure Policies (VDP)
- Common Vulnerabilities and Exposures
- Evidence of Intrusions
The Coalition stands behind these goals and is happy that CISA placed a focus on the seven areas, which are critical for organizations. The pledge also points to the National Institute of Standards and Technology’s (NIST) Secure Software Development Framework (SSDF), which is important.
The Pledge builds upon many recent actions by CISA, such as its multi-stakeholder paper on Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software. This work also complements and builds upon existing practices developed by NIST other U.S. federal agencies, industry groups, and international organizations.
Read Next
State, Fed Cyber Leaders Discuss Resilience in Light of Evolving Threat, Budget Landscapes
State and federal cyber leaders convened in Austin to discuss the Texas Cyber Command, utilizing Zero Trust strategies in an era of AI, and improving Federal to State cyber cooperation in an era of constricting resources and increased threats.
NIST: Analyzing Collusion Threats in the Semiconductor Supply Chain
Semiconductors power our modern technology and are often considered “the oil of the 21st century.” But producing these chips is not without challenges to the supply chain, including IP theft, counterfeiting, and reverse engineering.
Protecting Mobile Security in a Competitive Ecosystem
In an amicus brief filed in Epic Games v. Apple Inc., the Center for Cybersecurity Policy and Law urges the 9th Circuit to ensure that competition remedies do not undermine security.
