CISA Launches Secure by Design Pledge — April 30, 2024
CISA invited major technology manufacturers to commit to seven measurable secure-by-design goals covering memory-safe languages, MFA by default, and vulnerability disclosure performance.
Executive briefing: On the Cybersecurity and Infrastructure Security Agency (CISA) unveiled the Secure by Design Pledge, asking leading software and technology companies to commit to specific engineering improvements that measurably reduce exploitability. Initial signatories pledged to expand memory-safe programming languages, enable multi-factor authentication (MFA) by default, shorten vulnerability remediation timelines, and publish secure configuration baselines.
Pledge focus areas
- Memory safety. Increase adoption of memory-safe languages in new codebases and critical product updates.
- MFA by default. Deliver phishing-resistant authentication enabled by default for privileged and customer-facing accounts.
- Vulnerability management. Track patch timelines, coordinated disclosure performance, and security telemetry coverage.
Control alignment guidance
- Secure development lifecycle. Embed threat modeling, secure coding standards, and automated testing aligned with CISA’s pledge metrics.
- Identity governance. Extend MFA coverage metrics to include customer and partner access channels, reducing reliance on passwords.
- Supplier management. Require vendors to disclose Secure by Design commitments and progress, especially for critical SaaS and infrastructure providers.
Operational recommendations
- Benchmark internal engineering practices against the pledge goals and publish executive dashboards to track progress.
- Incorporate memory-safe language adoption and vulnerability remediation speed into engineering OKRs and incentive plans.
- Engage product marketing and customer success teams to communicate default security enhancements and support adoption.
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Cybersecurity Operations Playbook — Zeph Tech
Use Zeph Tech research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.