The CISA is actively seeking public feedback on its ‘secure by design’ guidance, a significant move in the realm of cybersecurity.
According to FedScoop, this initiative, titled “Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software,” initially published in April, has undergone an update in October. The update comes as a collaborative effort involving 17 domestic and foreign partners, reflecting the global importance of cybersecurity.
CISA’s white paper emphasizes the necessity for software manufacturers to incorporate stringent security principles from the onset of the design and development stages. This approach aims to ensure that all products reaching customers have inherent security features. The Wednesday request for information, published in the Federal Register, highlights CISA’s acknowledgment of the challenges in implementing security by design. However, it stresses the need for further comments and suggestions on this guiding framework.
The agency is particularly interested in insights regarding the economics of secure development versus the costs associated with incident response. They also seek public contributions on integrating security more comprehensively into computer science and software development education. CISA recognizes the hurdles smaller manufacturers might face in adopting these recommendations. Still, it sees this as an opportunity for innovation in the industry, potentially narrowing the gap between large and small players.
In the pursuit of enhancing cybersecurity, CISA’s RFI also includes prompts for feedback on several crucial aspects. These include the integration of security into the secure software development lifecycle, how secure-by-design principles can be weaved into computer science education, and general comments on the economics of implementing these practices. The agency points out the potential for engineering teams to establish a new rhythm where security is an intrinsic part of design, reducing maintenance efforts.
CISA’s statement in the RFI underlines the significance of this initiative: “Furthermore, engineering teams will be able to establish a new, steady-state rhythm in which security is built into the design and takes less effort to maintain.”
Copyright © 2024 RegTech Analyst
Copyright © 2018 RegTech Analyst
