In April 2023, CISA kicked off our Secure by Design initiative, the agency’s effort to shift the responsibility of security from end users to technology manufacturers, in line with the National Cybersecurity Strategy. As with any major milestone, it’s useful to pause for some self-reflection over a year’s worth of progress and lay out our goals for the year ahead.
At CISA, we live the cybersecurity mission every day, but no moment was as crystallizing for our agency and for our stakeholders as Director Easterly’s Congressional testimony regarding the cyber threat from the People’s Republic of China in February of this year. She stated, “CISA teams have found and eradicated Chinese intrusions into critical infrastructure across multiple sectors, including aviation, energy, water, and telecommunications. And what we’ve found to date is likely the tip of the iceberg... The truth is that, in many cases, the PRC is taking advantage of known product defects.”
Software insecurity is threat-agnostic—well-known and easily-exploited classes of defect make it easy for nation-state adversaries and criminals alike to compromise our critical infrastructure and put Americans at unacceptable risk. And so our Secure by Design initiative seeks to drive adoption of principles and approaches to prevent these defects from the design stage, where it is possible to eliminate entire classes of vulnerabilities.
Over the last year, CISA has driven momentum on the Secure by Design initiative by shifting the conversation and providing measurable and actionable recommendations to technology manufacturers. With domestic and international partners, we released two versions of our white paper, Shifting the Balance of Cybersecurity Risk, as well as guidance urging software manufacturers to adopt memory safety roadmaps. We also developed a new Secure by Design alert series which ties breaches in the news to the well-known product defects that enabled them. One of our most recent alerts focused on SQL injection vulnerabilities–a well-known type of defect that we continue to see widespread exploitation of, including some of the most pernicious ransomware extortion campaigns last year, despite knowing how to prevent these defects at scale for over 20 years.
We can’t keep issuing calls to customers to “patch harder” and expect that things will change. Technology manufacturers must focus on eliminating entire classes of vulnerability, rather than playing “whack-a-mole” with their defects. Many other industries have matured their processes to focus on customer safety—so too can the software industry. Remember, before a safer car could be made, we had to believe in the idea of a safer car. And that’s what we are asking of technology.
In addition to shifting the conversation, we’ve worked to get feedback from the public and the security community. Last summer, we held a “red pen” session at the annual hacker conference DEF CON in Las Vegas where we asked participants to mark up our draft Secure by Design white paper and provide feedback. Earlier this year, we issued a request for information to the public soliciting discussion on key questions surrounding economics and education, which we’re now reviewing responses to help inform our Secure by Design initiative and guidance going forward. And throughout the last 12 months, we’ve hit the road, speaking at various conferences and events, including South by Southwest, to take our message mainstream.
CISA has also worked to drive adoption of Secure by Design software through federal procurement. In March, the Office of Management and Budget and CISA announced the release of the secure software development attestation form, which is a core outcome of the President’s Executive Order 14028, which requires companies who supply software to the federal government to attest to secure software development practices.
We are proud of the progress we’ve made over the last year, but we know there is much more to do to achieve long-lasting security and resilience. As we head into our sophomore year, we at CISA will continue to educate the public on Secure by Design, drive adoption of the principles, and publish technical guidance for industry. We also plan to expand in the following ways in support of our vision:
- Drive awareness and a “secure by demand” approach to help customers know what to say to push their vendors to do better;
- Work to understand the costs and other economic forces that impact software security and insecurity;
- Work with the academic and educational communities to incorporate security into their computer science and coding programs.
We know we cannot do this alone. We appreciate the many partners across industry, civil society, the open source community, and academia who have joined us in this important endeavor. We’re optimistic that technology companies will join us, too. We believe that Secure by Design is our best hope for a more resilient future for our families, and for our country. We look forward to partnering to continue to advance progress.