Trustwave is proud to announce that it has signed the Cybersecurity and Infrastructure Security Agency (CISA) Secure by Design Pledge, joining more than 150 other leading enterprise software manufacturers in committing to building stronger security features directly into our products.
"Trustwave has always believed that software creators must bake in security from beginning to end," said Trustwave CISO Kory Daniels. "This is the only way to create an industry where vendors can be confident that the software they are using is as secure as possible, ultimately reducing supply chain risk. As the world has become more digital, the number of vulnerabilities identified has also grown continuously. Third-party products and services are essential for many supply chains, and they have a responsibility to adopt a secure by design culture to prevent further expanding an organization's attack surface."
This pledge is a significant milestone for CISA's Secure by Design initiative, which aims to shift the responsibility for cybersecurity from individual users to the manufacturers who create the software we rely on. These manufacturers can help make our critical infrastructure more secure by focusing on building security from the ground up.
"More secure software is our best hope to protect against the seemingly never-ending scourge of cyberattacks facing our nation," said CISA Director Jen Easterly. "I applaud the companies who have already signed our pledge for their leadership and call on all software manufacturers to take the pledge and join us in creating a world where technology is safe and secure right out of the box."
What Does the Pledge Entail?
By participating in the pledge, software manufacturers agree to make a good-faith effort to work towards specific security goals over the following year. In the case where a software manufacturer can make measurable progress towards a goal, the manufacturer should publicly document how they have achieved such progress within one year of signing the pledge. If the software manufacturer is unable to make measurable progress, the manufacturer is encouraged to, within one year of signing the pledge, share with CISA how the manufacturer has worked towards the goal and any challenges faced. In the spirit of radical transparency, the manufacturer is encouraged to publicly document its approach so that others can learn. This pledge is voluntary and not legally binding.
Software manufacturers who sign the pledge agree to work towards seven key goals over the next year. These goals target some of the most common cybersecurity vulnerabilities, and achieving them will significantly impact the overall security landscape.
The Seven Goals are:
- Increased Use of Multi-Factor Authentication (MFA ): MFA adds an extra layer of security beyond just a password, making it much harder for attackers to gain access to accounts.
- Eliminating Default Passwords: Default passwords are easy to guess and crack, so eliminating them is crucial for better security.
- Reducing Specific Vulnerabilities: Manufacturers will focus on identifying and eliminating entire classes of vulnerabilities in their software.
- Encouraging Security Patch Installation: Keeping software up to date with the latest security patches is essential, and the pledge aims to make this process easier for users.
- Publishing Vulnerability Disclosure Policies: These policies will allow security researchers to safely test software for vulnerabilities and report them to the manufacturer.
- Transparent Vulnerability Reporting: Manufacturers will provide more detailed information about vulnerabilities and issue security patches in a timely manner.
- Improved Detection of Intrusions: The pledge encourages manufacturers to develop tools that help users identify if their systems have been compromised.
"A more secure by design future is indeed possible. The items in the pledge directly address some of the most pervasive cybersecurity threats we at CISA see today, and by taking the pledge, software manufacturers are helping raise our national cybersecurity baseline," CISA Senior Technical Advisor Jack Cable said. "Every software manufacturer should recognize that they have a responsibility to protect their customers, contributing to our national and economic security. I appreciate the leadership of those who signed on and hope that every technology manufacturer will follow suit."
