U.S. and International Partners Publish Secure-by-Design and -Default Principles and Approaches   

Joint product outlines clear steps that technology providers can take to increase the safety of products used around the world 

 WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), and the cybersecurity authorities of Australia, Canada, United Kingdom, Germany, Netherlands, and New Zealand (CERT NZ, NCSC-NZ) published today “Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default.” This joint guidance urges software manufacturers to take urgent steps necessary to ship products that are secure-by-design and -default.  To create a future where technology and associated products are safe for customers, the authoring agencies urge manufacturers to revamp their design and development programs to permit only secure-by-design and -default products to be shipped to customers.  

 This guidance, the first of its kind, is intended to catalyze progress toward further investments and cultural shifts necessary to achieve a safe and secure future. In addition to specific technical recommendations, this guidance outlines several core principles to guide software manufacturers in building software security into their design processes prior to developing, configuring, and shipping their products, including:   

• Take ownership of the security outcomes of their technology products, shifting the burden of security from the customers. A secure configuration should be the default baseline, in which products automatically enable the most important security controls needed to protect enterprises from malicious cyber actors. 
• Embrace radical transparency and accountability—for example, by ensuring vulnerability advisories and associated common vulnerability and exposure (CVE) records are complete and accurate. 
• Build the right organizational structure by providing executive level commitment for software manufacturers to prioritize security as a critical element of product development.  

“Ensuring that software manufacturers integrate security into the earliest phases of design for their products is critical to building a secure and resilient technology ecosystem,” said CISA Director Jen Easterly. “These secure by design and secure by default principles aim to help catalyze industry-wide change across the globe to better protect all technology users. As software now powers the critical systems and services we collectively rely upon every day, consumers must demand that manufacturers prioritize product safety above all else.” 

“Insecure technology products can pose risks to individual users and our national security,” said NSA Cybersecurity Director Rob Joyce. “If manufacturers consistently prioritize security during design and development, we can reduce the number of malicious cyber intrusions we see. The international coalition partnering on this report speaks to the importance of this issue.”  

“The FBI is committed to identifying ways to better protect our citizens from the agility and versatility of cyber crime, and today's announcement is a direct example of this,” said Bryan Vorndran, Assistant Director of the FBI's Cyber Division. “Working with our federal and international partners on this cyber security guide provides us with the opportunity to pave the way forward to ensure safety and security in a digitally connected world.”

“Cyber security cannot be an afterthought,” said Abigail Bradshaw CSC, Head of the Australian Cyber Security Centre. “Consumers deserve products that are secure from the outset. Strong and ongoing engagement between government, industry and the public is vital to putting cyber security at the centre of the technology design process.”   

“As our lives become increasingly digital, it is vital technology products are being designed and developed in a way that holds security as a core requirement,” said Lindy Cameron, UK National Cyber Security Centre CEO. “Our new joint guide aims to drive the conversation around security standards and help turn the dial so that the burden of cyber risk is no longer carried largely by the consumer. We call on technology manufacturers to familiarise themselves with the advice in this guide and implement secure-by design and by-default practices into their products to help ensure our society is secure and resilient online.”  

“The Communications Security Establishment and it’s Canadian Centre for Cyber Security are proud to be a part of this important effort alongside our international partners,” said Sami Khoury, Head, Canadian Centre for Cyber Security. “We recommend that organizations adopt these secure-by-design and secure-by-default principles, creating safe products for all and ultimately shifting the balance of cyber security risk away from customers.  This release is the first step towards creating a more secure technological future for everyone. We look forward to continued work with partners in industry and cybersecurity to implement the recommendations in this important guide.”

“Secure soft- and hardware are the foundation for a secure use of IT products in government, business and society,” said Gerhard Schabhüser, acting President of Federal Office for Information Security Germany. “In view of this, the BSI requests manufacturers to consider IT security right from the beginning and to enable users to securely utilise their products by secure configuration settings by default.”

“In a world rapidly digitalizing, citizens should be protected from digital threats,” said Hans de Vries, Director of National Cyber Security Centre Netherlands. “It is important that governments and industry take their responsibility for the security of end-users, with, for example, taking security-by-design and security-by-default as a starting point when developing software.”  

“An essential read for organisations wanting to contribute to global cyber resilience, said Rob Pope, Director of Computer Emergency Response Team New Zealand. “By creating products that are secure, both by design and by default, manufacturers can take much of the burden from end-users. We know many manufacturers are already doing this and hopefully we can encourage others to take it up. These steps are the cyber equivalent of seatbelts, simple inbuilt default practices that keep people safe. This publication shows that the government of Aotearoa New Zealand is serious about keeping people secure online.”

“Customers should have confidence that technology products are designed with information security as a key factor from the outset, and that security remains a central consideration throughout the product’s lifecycle,” said Lisa Fong Deputy Director-General National Cyber Security Centre New Zealand (NCSC-NZ). “We recognise the need for governments to work closely with industry and we hope this guidance prompts useful conversations, as well as helping organisations to understand the importance of robust security as a factor when making purchasing decisions.”

Many private sector partners have made invaluable contributions toward advancing security-by-design and security-by-default. With this joint guide, the authoring agencies seek to progress an international conversation about key priorities, investments, and decisions necessary to achieve a future where technology is safe, secure, and resilient by design and default. Feedback on this guide is welcome and can be sent to SecureByDesign@cisa.dhs.gov.

For more information on CISA’s efforts to promote secure-by-design and -default principles, visit our webpage.   

About CISA 

As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure Americans rely on every hour of every day.

Visit CISA.gov for more information and follow us on Twitter, Facebook, LinkedIn, Instagram.