ISC2 Spotlight Event: CISA Wants Customers to Help Shift Cybersecurity Burden onto Digital Product Suppliers

nnSenior security advisor tells conference that the US agency is examiningnways to secure open source.nn

n

nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) wantsncustomers to push software manufacturers to create more secure products, thenagency’s senior technical advisor told ISC2 members this week as part of thennISC2 Spotlight event on Secure Software Development.n

n

nIt is also looking more closely at ways to bolster the security ofnopen-source software, CISA’s senior technical advisor, Jack Cable, toldnattendees.n

n

nThe organizationnnpublished a whitepapernnearlier this year on Security by Design, which called for the burden ofncybersecurity risk to shift from “least capable” – small companies, schools,nand local government for example – to those “most capable”.n

n

nWho are the most capable? “That’s the manufacturers … that are buildingnthese products in a way that have vulnerabilities or misconfigurations thatncontinue to get exploited by attackers.” This is in line with the broadernU.S. national security effort around cybersecurity.n

n

n

n

Secure by Design is the Default Stance

n

n

n

nEnsuring products are both secure by design and secure by default, isncentral to CISA’s strategy, Cable explained. The former includes actionsnlike detailing artifacts, producing software bills of materials (SBOMs), andnlaying out roadmaps towards using memory safe languages. The latter includesnensuring products are secure “right out of the box” and don’t place an unduenburden on the user.n

n

nHe explained that CISA was pursuing a three-point strategy where softwarenmanufacturers should: own security outcomes, and view customer security asnan extension of vendor security; engage in “radical transparency andnaccountability; and build organizational structures to ensure this “from thenCEO down.”n

n

nHe added, “security can’t be a second-class citizen to sales or growth.”n

n

nCable said one particular interest for him was ensuring that manufacturersnhave vulnerability disclosure polices, “or ideally bug bounties that offernlegal safe harbor so that researchers aren’t scared of legal action. Theynshould allow researchers to talk publicly about their findings.”n

n

nThe organization’s recently updated whitepaper went into more detail on thenactions manufacturers can take to make their products more secure from thenoutset, he said, rather than leaving it in the hands of users.n

n

n“It’s not easy to be a user of tech products today…but everybody has to be anuser of tech products,” he continued.n

n

nWhen applications or products are not secure out of the box, customers aren“inheriting all this work.” That ranges from resetting default passwords andnpatching vulnerabilities in the first instance, to longer term burdens suchnas paying extra for IAM tools, hardening security, and more.n

n

n

n

Improving Education to Tackle Cybersecurity

n

n

n

nThe organization also wants cybersecurity to be a fundamental part of thencompsci curriculum rather than an option. Cable noted that of the top 20ncompsci universities in the U.S., only one required security to be taught atnundergraduate level.n

n

nWhile CISA is pushing industry on this, and the U.S. government was usingnits own purchasing might to push this agenda, end users had a part to play,nhe said. “How do we start to get customers really asking more and asking thenright questions of their vendors?n

n

n“We want customers to really start asking for these… start asking theirnvendor, ‘What is your secure by design roadmap? Or can you give me yournSBOMs?’” Customers should ask suppliers “how are you training yournemployees, or how are you actually looking for security when you’re hiringnsoftware developers.”n

n

n“The more that … customers can really create that demand signal, the betternoff we are.”n

n

nShipping insecure software or digital products was a business decision onnthe part of manufacturers, he said. Often the response to CISA’s efforts wasn“who’s going to pay?”n

n

nBut he continued, “Our response is we’re paying for this. It’s justnoffloaded onto the customers.”n

n

nSecurity by design isn’t free, and isn’t cheap to implement, he accepted.nBut compared to the existing costs associated with a lack of security, fromnransom payments, breach costs, and the costs of additional security, “Wenthink it’s better in the long run.”n

n

nAnd beyond the economic impact, there is a broader issue of the “nationalnsecurity delta”, to consider. An unacceptable lack of security was causingncritical infrastructure to be vulnerable to ransomware attacks, he said.n

n

nHaving customers prioritize security in discussion with suppliers, “andnenforcing that through contract language, or their purchasing decisions, Inthink that is one of the best ways we can go about doing this.”n

n

n

n

Not Just a Proprietary Consideration

n

n

n

nThis was not just an issue for closed source vendors, Cable said. Thenorganization recently ran a request for information in conjunction withnother agencies on open-source and memory safety, he said. “We got some verynthoughtful responses.”n

n

nCable added, “We want to see how the federal government and CISA can helpnand spur additional improvements in security recognizing all the manynbenefits that we’ve gotten from open-source.”n

n

nHe noted that the U.S. government was itself a major user of open-source,nand “has a responsibility to contribute back.”n

n

nThe government was building out partnerships with open-source communities,nhe said. “For instance, principles for security for package managers, whonare in a really great position to help raise the security baseline of thenopen-source community broadly.”n

n

nThe responses to the request for information would help it work out where itncould get the biggest bang per buck, Cable said.n

n

nIt should be the responsibility of every company producing software, to bengood stewards “of the open source that they’re dependent upon, that they’renintegrating and using to sell their products to their customers.”n

n

nThe pervasiveness of open-source means, “It’s really everyone’snresponsibility who uses open-source software to help maintain thatnecosystem.”

n

n
• More information on this ISC2 Spotlight can be foundn n here.
n
• Forthcoming ISC2 conferences and Spotlights are listed on ourn n Events page.
n
• There are a range ofn n Skill-Builders available focused on software security, all of which can earn you CPE credits and are free to ISC members.
n

]]>