Cybersecurity Policy Report, FTC Calls for Systematic Handling of Cyber Vulnerabilities, (Apr 19, 2024)

By Tony Foley

A Wednesday blog post by the Federal Trade Commission’s Office of Technology outlines the office’s thoughts on addressing the risk of cybersecurity vulnerabilities in complex systems.

The blog post notes that the FTC has been bringing enforcement actions based on poor security practices for years, often related to issues such as failure to encrypt sensitive data, storing credentials in source code, failure to test common vulnerabilities, and failure to use multifactor authentication, among others. An earlier post from February 2023 discussed how the FTC’s enforcement orders incorporate modern security best practices that take inspiration from research into the causes of risk in complex systems. The latest post builds on that guidance, discussing how to effectively address such risks.

Specifically, the post argues that the best way to address risks of security vulnerabilities in products is systematically, rather than with one-off or ad hoc actions. “In the same way that ‘human error’ is not an appropriate diagnosis for the cause of a successful credential phishing attack—given the availability of phishing-resistant multifactor authentication methods—it’s also not an appropriate diagnosis for many of the other types of vulnerabilities and system security issues that occur,” the post said. The FTC said this approach was consistent with the Cybersecurity and Infrastructure Security Agency’s Secure By Design series, which urges technology manufacturers to build security into products from the beginning to eliminate classes of vulnerabilities or product defects.

The post cites several known approaches to addressing vulnerabilities systematically and preemptively to prevent them entirely or dramatically reduce their likelihood, including the following:

Cross-site scripting, which occurs when content controlled by an attacker is directly incorporated into an html page, can be addressed by using template rendering systems that default to escaping output;

SQL injection, which occurs when attacker-controlled content is directly incorporated into a database SQL query, can be addressed by query builders and other application programming interfaces (APIs) that clearly delineate between attacker-controlled data and the structure of a query; and

Buffer overflows and use-after-free vulnerabilities, which relate to how software manages memory, can be addressed through the use of memory-safe programming languages.

The post concludes by emphasizing that companies have a legal obligation to effectively protect users’ data and that unfair or deceptive data security practices violate the FTC Act, adding that specific laws related to securing personal information or properly disposing of such information apply to financial institutions, consumer reporting companies, and companies collecting children’s data.

News: FederalLegislation DataSecurity DataPrivacy