Last week, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) released guidance on Security-by-Design and Security-by-Default principles for technology manufacturers that was jointly developed by the Federal Bureau of Investigation and the National Security Agency, as well as cybersecurity authorities in Australia, Canada, United Kingdom, Germany, Netherlands, and New Zealand.  While similar principles have been published in the past, such as those released by the U.S. Federal Trade Commission, this guidance builds on the White House’s recent roll-out of the U.S. National Cybersecurity Strategy and is in line with efforts to encourage a consistent, international approach to software security that emphasizes the responsibilities of software manufacturers across various jurisdictions.  While the guidance primarily focuses on recommendations for technology manufacturers, it also includes recommendations for enterprise customers to “hold their supplying technology manufacturers accountable for the security outcomes of their products.”  CISA and the authoring agencies are seeking feedback on the guidance, and indicated plans to hold future listening sessions to collect feedback. 

CISA and the authoring agencies emphasize that Secure-by-Design and Secure-by-Default principles will enhance cybersecurity by shifting responsibility to software manufacturers.  The preamble encourages technology manufacturers to “take ownership of improving security outcomes for customers” by “revamp[ing] . . . design and development programs to permit only Secure-by-Design and –Default products to be shipped to customers.”  According to the authoring agencies, such a future state would “prevent[] customers from having to constantly perform monitoring, routine updates, and damage control on their systems to mitigate cyber intrusions.”  Instead, the guidance aims to have manufacturers assume much of this burden in order to reduce the risk of security incidents through common issues such as customers’ misconfigurations or “insufficiently fast patching.”  The guidance also notes that the EU’s Cyber Resilience Act reflects this perspective, emphasizing that manufacturers should “implement security throughout a product‘s life-cycle in order to prevent manufacturers from introducing vulnerable products into the market.”

The guidance establishes three “core principles” to guide software manufacturers in building software security into their design processes:

  1. the burden of security should not fall solely on the customer,
  2. manufacturers should embrace “radical” transparency and accountability, and
  3. manufacturers should build organizational structure and leadership to achieve these goals, including executive-level commitment to implement changes. 

To implement these three principles, the guidance suggests that manufacturers should “consider several operational tactics to evolve their development processes,” including: 

  • Convening routine meetings with company executive leadership focused on Security-by-Design and Security-by-Default principles, and establishing policies and procedures that reward production teams that adhere to these principles;
  • Operating around the importance of software security to business success by assigning a “software security leader” or “software security team” and having “robust, independent product security assessment and evaluation programs;” and
  • Using tailored threat models during development “to prioritize the most critical and high-impact products.”

In addition to these strategic steps, the authoring agencies also provide specific guidance on implementing Secure-by-Design and Secure-by-Default principles.

Secure-by-Design Principles and Guidance

The guidance describes Secure-by-Design products as those that “are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices, data, and connected infrastructure.”  The guidance highlights a number of recommendations for software manufacturers to consider in building Secure-by-Design products, including performing risk assessments to “identify and enumerate prevalent cyber threats to critical systems,” using defense-in-depth and “tailored threat models” during product development to address potential threats, “include[ing] protections in product blueprints that account for the evolving cyber threat landscape,” and developing written roadmaps to align existing product portfolios with secure-by-design practices.

The guidance also notes that “the Secure Software Development Framework, also known as the National Institute of Standards and Technology’s SP 800-218, is a core set of high-level secure software development practices that can be integrated into each stage of the software development lifecycle.”  The authoring agencies encourage the development of a written “roadmap” to adopt Secure-by-Design software development practices, including the use of peer code review and security testing, as well as establishing vulnerability disclosure programs.  Notably, CISA’s guidance also cites the use of CISA’s Cybersecurity Performance Goals (“CPGs”) as a key baseline for delivering Secure-by-Design products, stating that a manufacturer that “fails to meet the CPGs . . . cannot be seen as delivering Secure-by-Design products.” 

Secure-by-Default Principles and Guidance

The guidance describes Secure-by-Default products as those that “are resilient against prevalent exploitation techniques out of the box without additional charge … [and] without end-users having to take additional steps to secure them.”  The authoring agencies describe several examples of tactical steps that can be taken by manufacturers to prioritize Secure-by-Default configurations in their products, including:  eliminating default passwords, implementing single sign-on via modern open standards, providing high-quality audit logs without an additional charge, and considering the user experience consequences of security settings, among others.  The guidance also recommends that rather than developing hardening guides that list methods for securing products, software manufacturers should integrate hardening guide recommendations into default configurations and shift to provide “loosening guides” that explain which changes users can make and “the resulting security risks” of doing so. 

Recommendations for Customers

While most of the guidance is aimed at manufacturers, the guidance also includes recommendations for enterprise customers to “hold their supplying technology manufacturers accountable for the security outcomes of their products.”  These recommendations include prioritizing the importance of purchasing Secure-by-Design and Secure-by-Default products from an executive level, such as by empowering IT or security departments to develop purchasing criteria that prioritize these practices, requiring pre-purchase security assessments of third-party software, and “empowering the IT or security department to push back” on security issues “if necessary.”  Notably, the guidance specifically recommends that organizational decisions “to accept the risks associated with specific technology products should be formally documented, approved by a senior business executive, and regularly presented to the Board of Directors” (emphasis added). 

The guidance also recommends that organizations view “[k]ey enterprise IT services that support an organization’s security posture” as “critical business functions” that are funded appropriately, and partner with industry peers and manufacturers to reinforce Secure-by-Design and Secure-by-Default practices.  Cloud customers should also ensure they understand their cloud provider’s shared responsibility model, including the provider’s security responsibilities.

Next Steps

The authoring agencies note that the guidance is intended to progress a conversation about priorities, investments, and decisions “necessary to achieve a future where technology is safe, secure, and resilient by design and default.”  CISA and other agencies are seeking feedback on the guidance from interested parties, and state that they intend to convene a series of future listening sessions to further refine this guidance.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Caleb Skeath Caleb Skeath

Caleb Skeath advises clients on a broad range of cybersecurity and privacy issues, including cybersecurity incident response, cybersecurity and privacy compliance obligations, internal investigations, regulatory inquiries, and defending against class-action litigation. Caleb holds a Certified Information Systems Security Professional (CISSP) certification.

Caleb specializes…

Caleb Skeath advises clients on a broad range of cybersecurity and privacy issues, including cybersecurity incident response, cybersecurity and privacy compliance obligations, internal investigations, regulatory inquiries, and defending against class-action litigation. Caleb holds a Certified Information Systems Security Professional (CISSP) certification.

Caleb specializes in assisting clients in responding to a wide variety of cybersecurity incidents, ranging from advanced persistent threats to theft or misuse of personal information or attacks utilizing destructive malware. Such assistance may include protecting the response to, and investigation of an incident under the attorney-client privilege, supervising response or investigation activities and interfacing with IT or information security personnel, and advising on engagement with internal stakeholders, vendors, and other third parties to maximize privilege protections, including the negotiation of appropriate contractual terms. Caleb has also advised numerous clients on assessing post-incident notification obligations under applicable state and federal law, developing communications strategies for internal and external stakeholders, and assessing and protecting against potential litigation or regulatory risk following an incident. In addition, he has advised several clients on responding to post-incident regulatory inquiries, including inquiries from the Federal Trade Commission and state Attorneys General.

In addition to advising clients following cybersecurity incidents, Caleb also assists clients with pre-incident cybersecurity compliance and preparation activities. He reviews and drafts cybersecurity policies and procedures on behalf of clients, including drafting incident response plans and advising on training and tabletop exercises for such plans. Caleb also routinely advises clients on compliance with cybersecurity guidance and best practices, including “reasonable” security practices.

Caleb also maintains an active privacy practice, focusing on advising technology, education, financial, and other clients on compliance with generally applicable and sector-specific federal and state privacy laws, including FERPA, FCRA, GLBA, TCPA, and COPPA. He has assisted clients in drafting and reviewing privacy policies and terms of service, designing products and services to comply with applicable privacy laws while maximizing utility and user experience, and drafting and reviewing contracts or other agreements for potential privacy issues.

Photo of Ashden Fein Ashden Fein

Ashden Fein advises clients on cybersecurity and national security matters, including crisis management and incident response, risk management and governance, government and internal investigations, and regulatory compliance.

For cybersecurity matters, Mr. Fein counsels clients on preparing for and responding to cyber-based attacks, assessing…

Ashden Fein advises clients on cybersecurity and national security matters, including crisis management and incident response, risk management and governance, government and internal investigations, and regulatory compliance.

For cybersecurity matters, Mr. Fein counsels clients on preparing for and responding to cyber-based attacks, assessing security controls and practices for the protection of data and systems, developing and implementing cybersecurity risk management and governance programs, and complying with federal and state regulatory requirements. Mr. Fein frequently supports clients as the lead investigator and crisis manager for global cyber and data security incidents, including data breaches involving personal data, advanced persistent threats targeting intellectual property across industries, state-sponsored theft of sensitive U.S. government information, and destructive attacks.

Additionally, Mr. Fein assists clients from across industries with leading internal investigations and responding to government inquiries related to the U.S. national security. He also advises aerospace, defense, and intelligence contractors on security compliance under U.S. national security laws and regulations including, among others, the National Industrial Security Program (NISPOM), U.S. government cybersecurity regulations, and requirements related to supply chain security.

Before joining Covington, Mr. Fein served on active duty in the U.S. Army as a Military Intelligence officer and prosecutor specializing in cybercrime and national security investigations and prosecutions — to include serving as the lead trial lawyer in the prosecution of Private Chelsea (Bradley) Manning for the unlawful disclosure of classified information to Wikileaks.

Mr. Fein currently serves as a Judge Advocate in the U.S. Army Reserve.

Photo of Micaela McMurrough Micaela McMurrough

Micaela McMurrough has represented clients in high-stakes antitrust, patent, trade secrets, contract, and securities litigation, and other complex commercial litigation matters, and serves as co-chair of Covington’s global and multi-disciplinary Internet of Things (IoT) group. She also represents and advises domestic and international…

Micaela McMurrough has represented clients in high-stakes antitrust, patent, trade secrets, contract, and securities litigation, and other complex commercial litigation matters, and serves as co-chair of Covington’s global and multi-disciplinary Internet of Things (IoT) group. She also represents and advises domestic and international clients on cybersecurity and data privacy issues, including cybersecurity investigations and cyber incident response. Micaela has advised clients on data breaches and other network intrusions, conducted cybersecurity investigations, and advised clients regarding evolving cybersecurity regulations and cybersecurity norms in the context of international law.

In 2016, Micaela was selected as one of thirteen Madison Policy Forum Military-Business Cybersecurity Fellows. She regularly engages with government, military, and business leaders in the cybersecurity industry in an effort to develop national strategies for complex cyber issues and policy challenges. Micaela previously served as a United States Presidential Leadership Scholar, principally responsible for launching a program to familiarize federal judges with various aspects of the U.S. national security structure and national intelligence community.

Prior to her legal career, Micaela served in the Military Intelligence Branch of the United States Army. She served as Intelligence Officer of a 1,200-member maneuver unit conducting combat operations in Afghanistan and was awarded the Bronze Star.

Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.
Photo of Matthew Harden Matthew Harden

Matthew Harden is a litigation associate in the firm’s New York office and advises on a broad range of cybersecurity, data privacy, and national security matters, including cybersecurity incident response, cybersecurity and privacy compliance obligations, internal investigations, and regulatory inquiries.

Photo of Shayan Karbassi Shayan Karbassi

Shayan Karbassi is an associate in the firm’s Washington, DC office. He is a member of the firm’s Data Privacy and Cybersecurity and White Collar and Investigations Practice Groups. Shayan advises clients on a range of cybersecurity and national security matters. He also…

Shayan Karbassi is an associate in the firm’s Washington, DC office. He is a member of the firm’s Data Privacy and Cybersecurity and White Collar and Investigations Practice Groups. Shayan advises clients on a range of cybersecurity and national security matters. He also maintains an active pro bono practice.