Cybersecurity Policy Report, Top Software, Cloud Providers Sign Cybersecurity Pledge, (May 9, 2024)

By Tom Leithauser

A pledge signed by 68 leading software manufacturers and cloud service providers to adopt “secure-by-design” principles is a “watershed moment” for the world’s cyber defenders that promises to one day make ransomware attacks a “shocking anomaly,” according to Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency.

“Our goal for the entire community is to shift the security burden from individuals and small businesses—in other words, end users whose business is not a technology development effort or cybersecurity—to technology manufacturers whose business it is and who are in the best position to address and manage security risks,” Ms. Easterly said yesterday evening at the RSA cybersecurity conference in San Francisco.

CISA chose this year’s RSA conference, a four-day event attended by thousands of cybersecurity practitioners, to announce that it had persuaded Google LLC, Microsoft Corp., and a “who’s who” of industry giants to voluntarily adopt a set of principles developed by CISA and its international partners.

A defensive posture that responds one-by-one to cybersecurity incidents has proven to be inadequate in a world where sophisticated state-sponsored hackers easily penetrate the networks of critical infrastructure to prepare for attacks that could disrupt essential services in the U.S. and elsewhere, Ms. Easterly said.

“We have the power to change this, and we don’t have to be chained to the way things are. We can together achieve long-term security through fundamentally more secure software,” she told the RSA audience.

“The only way to make ransomware a shocking anomaly is to ensure that the technology that we rely upon every hour of every day is built, tested, designed, deployed, [and] delivered to be secure by design,” she added.

“Participating software manufacturers are pledging to work over the next year to demonstrate measurable progress towards seven concrete goals. Collectively, these commitments will help protect Americans by securing the technology that our critical infrastructure relies on,” CISA said in a news release.

The pledge is a voluntary commitment to demonstrate progress toward the following seven goals: (1) implement multi-factor authentication, (2) eliminate default passwords, (3) reduce “entire classes of vulnerabilities” by, for example, rewriting software in more secure languages, (4) accelerate vulnerability patching and make it easy for customers to apply patches, (5) establish vulnerability disclosure policies that encourage security researchers to report vulnerabilities, (6) offer timely disclosures of vulnerabilities with user guidance on patching or mitigating the vulnerabilities, and (7) maintain logs or other records to enable users to detect intrusions.

“To enable a variety of approaches, software manufacturers participating in the pledge have the discretion to decide how best they can meet and demonstrate the core criteria of each goal,” the pledge says.

“Demonstrating measurable progress across the manufacturer’s products can take a variety of forms—such as by taking action on all the manufacturer’s products, or by choosing a set of products to first address and publishing a roadmap for other products,” it says.

“In the case where a software manufacturer is able to make measurable progress towards a goal, the manufacturer should publicly document how they have achieved such progress within one year of signing the pledge,” it says.

“Where the software manufacturer is not able to make measurable progress, the manufacturer is encouraged to, within one year of signing the pledge, share with CISA how the manufacturer has worked towards the goal and any challenges faced,” the pledge adds.

CISA’s secure-by-design push is part of its effort to achieve the goals of the National Cybersecurity Strategy issued by the White House last year. The strategy aims to shift the cybersecurity burden “away from end users and individuals to technology manufacturers who are most able to bear it,” according to CISA.

“Security must be prioritized over all else. Security must be prioritized over cool features and speed to market,” Ms. Easterly said.

The effort has been endorsed by 14 U.S. allies that signed onto a white paper describing secure-by-design principles (CPR, Oct. 17, 2023), and the impact of the pledge will be felt globally because many of the participating software manufacturers have an international presence, Ms. Easterly noted.

The international aspect of the campaign was demonstrated today when CISA joined cyber defenders from Australia, Canada, New Zealand, and the United Kingdom—the “Five Eyes” national security alliance—to release a white paper with additional secure-by-design guidance.

The CISA pledge focuses on “enterprise software products and services, including on-premises software, cloud services, and software as a service (SaaS),” CISA explained.

“Physical products such as IoT devices and consumer products are not scoped in the pledge, though companies who wish to demonstrate progress in those areas are welcome to do so,” it said.

In addition to Google and Microsoft, some of the more well-known companies that signed the pledge include Amazon Web Services, Inc. (AWS), Cisco Systems, Inc., Hewlett Packard Enterprise Co., and IBM.

“From day one, we have pioneered secure by design and secure by default practices in the cloud, so AWS is designed to be the most secure place for customers to run their workloads. We are committed to continuing to help organizations around the world elevate their security posture, and we look forward to collaborating with CISA and other stakeholders to further grow and promote security by design and default practices,” Chris Betz, AWS’s chief information security officer, said in a statement.

“Microsoft is delighted to join CISA’s Secure by Design pledge and other signatories to strengthen the cybersecurity and resilience of the ecosystem,” said Bret Arsenault, Microsoft’s chief cybersecurity adviser. “This builds on the ongoing public/private partnerships we believe drive systemic change and improvements globally.”

News: FederalLegislation InternationalLegislation DataSecurity