Tech Companies Promise 'Secure by Design' Products

RSA CONFERENCE 2023 – San Francisco – More than 60 vendors have signed the Secure by Design pledge — a commitment to develop secure products spearheaded by the Cybersecurity and Infrastructure Security Agency (CISA).

CISA defines "secure by design" products as "those where the security of the customers is a core business requirement, not just a technical feature." Companies that adopt these principles are promising to consider security during the design phase and throughout the product life cycle to create more resilient products.

Instead of putting the onus of security on individuals and small businesses, the goal is to put the responsibility on the manufacturers that are making the products. The voluntary pledge focuses on enterprise software products and services, including cloud services, software-as-a-service, and on-premises software.

"There is a real urgency that everybody in this room not only feels but is highly aware of, and it is all about developing new and retrofitting older technologies and software with security as a core consideration," said CISA Director Jen Easterly at the RSA Conference in San Francisco this week.

Signatories to the pledge are asked to consider seven core goals and demonstrate their progress toward meeting those goals within one year. How they demonstrate progress, and the order they address the goals, is up to the individual companies, and there are no penalties for falling short. The goals are:

CISA launched its Secure by Design effort in April last year, urging "software manufacturers to take urgent steps necessary to ship products that are secure by design and revamp their design and development programs to permit only secure by design products to be shipped to customers." Earlier this year, CISA released a self-attestation form and repository that software makers can use to provide security details about their products. Federal agencies can look up the information to ensure the software they are buying has been created using secure development practices.

Amazon Web Services, BlackBerry, Cisco, CrowdStrike, Fortinet, GitHub, Google, Hewlett Packard, IBM, Ivanti, Lenovo, Microsoft, Netgear, Okta, and Palo Alto Networks have signed the pledge.

"Government can't do this alone. Private industry can't do this alone," Easterly said. "We have to bring the community together."