Monday , April 21 2025

CISA’s Secure by Design Turns 1! (VIDEO)

In April 2023, CISA kicked off our Secure by Design initiative, the agency’s effort to shift the responsibility of security from end users to technology manufacturers, in line with the National Cybersecurity Strategy. As with any major milestone, it’s useful to pause for some self-reflection over a year’s worth of progress and lay the goals for the year ahead.

CISA lives the cybersecurity mission, but no moment was as crystallizing for the agency and for the stakeholders as Director Easterly’s Congressional testimony regarding the cyber threat from the People’s Republic of China in February of this year. She stated, “CISA teams have found and eradicated Chinese intrusions into critical infrastructure across multiple sectors, including aviation, energy, water, and telecommunications. And what we’ve found to date is likely the tip of the iceberg… The truth is that, in many cases, the PRC is taking advantage of known product defects.”

Samsung phone is saving your passwords in plain text

You copy a password from your manager, thinking it's safe. Meanwhile, your phone is saving it in plain text. Samsung...
Read More
Samsung phone is saving your passwords in plain text

UK Software Firm Exposed 8 million of Healthcare Worker Records

A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured...
Read More
UK Software Firm Exposed 8 million of Healthcare Worker Records

GitHub Enterprise Server Vulns Expose Risk of Code Execution

GitHub has released security updates for GitHub Enterprise Server to fix several vulnerabilities, including a high-severity flaw that could allow...
Read More
GitHub Enterprise Server Vulns Expose Risk of Code Execution

CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers

Hackers can exploit a vulnerability in Asus routers to execute unauthorized functions. This serious issue, rated 9.2 out of 10,...
Read More
CVE-2025-2492  ASUS warns of critical auth bypass flaw in routers

16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia

According to Shadowserver Foundation around 17,000 Fortinet devices worldwide have been compromised using a new technique called "symlink". This number...
Read More
16,000+  Fortinet devices compromised with symlink backdoor, Mostly in Asia

Patch now! Critical Erlang/OTP SSH Vuln Allows UCE

A critical security flaw has been found in the Erlang/Open Telecom Platform (OTP) SSH implementation, allowing an attacker to run...
Read More
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE

CISA warns of increasing risk tied to Oracle legacy Cloud leak

On Wednesday, CISA alerted about increased breach risks due to the earlier compromise of legacy Oracle Cloud servers, emphasizing the...
Read More
CISA warns of increasing risk tied to Oracle legacy Cloud leak

CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App

Cisco issued a security advisory about a serious vulnerability in its Webex App that allows unauthenticated remote code execution (RCE)...
Read More
CVE-2025-20236  Cisco Patches Unauthenticated RCE Flaw in Webex App

Apple released emergency security updates for 2 zero-day vulns

On Wednesday, Apple released urgent operating system updates to address two security vulnerabilities that had already been exploited in highly...
Read More
Apple released emergency security updates for 2 zero-day vulns

Oracle Released Patched for 378 flaws for April 2025

On April 15, 2025, Oracle released a Critical Patch Update for 378 flaws for its products. The patch update covers...
Read More
Oracle Released Patched for 378 flaws for April 2025

Software insecurity is threat-agnostic—well-known and easily-exploited classes of defect make it easy for nation-state adversaries and criminals alike to compromise our critical infrastructure and put Americans at unacceptable risk. And so our Secure by Design initiative seeks to drive adoption of principles and approaches to prevent these defects from the design stage, where it is possible to eliminate entire classes of vulnerabilities.

Over the last year, CISA has driven momentum on the Secure by Design initiative by shifting the conversation and providing measurable and actionable recommendations to technology manufacturers. With domestic and international partners, we released two versions of our white paper, Shifting the Balance of Cybersecurity Risk, as well as guidance urging software manufacturers to adopt memory safety roadmaps. We also developed a new Secure by Design alert series which ties breaches in the news to the well-known product defects that enabled them. One of our most recent alerts focused on SQL injection vulnerabilities–a well-known type of defect that we continue to see widespread exploitation of, including some of the most pernicious ransomware extortion campaigns last year, despite knowing how to prevent these defects at scale for over 20 years.

CISA can’t keep issuing calls to customers to “patch harder” and expect that things will change. Technology manufacturers must focus on eliminating entire classes of vulnerability, rather than playing “whack-a-mole” with their defects. Many other industries have matured their processes to focus on customer safety—so too can the software industry. Remember, before a safer car could be made, we had to believe in the idea of a safer car. And that’s what we are asking of technology.

In addition to shifting the conversation, CISA have worked to get feedback from the public and the security community. Last summer, we held a “red pen” session at the annual hacker conference DEF CON in Las Vegas where the asked participants to mark up our draft Secure by Design white paper and provide feedback. Earlier this year, we issued a request for information to the public soliciting discussion on key questions surrounding economics and education, which we’re now reviewing responses to help inform our Secure by Design initiative and guidance going forward. And throughout the last 12 months, we’ve hit the road, speaking at various conferences and events, including South by Southwest, to take our message mainstream.

CISA has also worked to drive adoption of Secure by Design software through federal procurement. In March, the Office of Management and Budget and CISA announced the release of the secure software development attestation form, which is a core outcome of the President’s Executive Order 14028, which requires companies who supply software to the federal government to attest to secure software development practices.

CISA is proud of the progress we’ve made over the last year, but CISA know there is much more to do to achieve long-lasting security and resilience. As CISA head into our sophomore year, CISA will continue to educate the public on Secure by Design, drive adoption of the principles, and publish technical guidance for industry. We also plan to expand in the following ways in support of our vision:

Drive awareness and a “secure by demand” approach to help customers know what to say to push their vendors to do better;
Work to understand the costs and other economic forces that impact software security and insecurity;
Work with the academic and educational communities to incorporate security into their computer science and coding programs.

CISA stated that they cannot do this alone. CISA appreciate the many partners across industry, civil society, the open source community, and academia who have joined us in this important endeavor.  CISA We’re optimistic that technology companies will join us, too. We believe that Secure by Design is our best hope for a more resilient future for our families, and for our country. We look forward to partnering to continue to advance progress.

Check Also

ANY.RUN

Top 10 Malware Threats of the Week: Reports ANY.RUN

Cybersecurity platform ANY.RUN recently reported the top 10 malware threats of the week, highlighting a …

Leave a Reply

Your email address will not be published. Required fields are marked *