CISA boss: Makers of insecure software are the real cyber villains

CISA Director Jen Easterly used a keynote at Mandiant’s mWise conference to argue that software vendors must stop shipping insecure products—reframing vulnerabilities as product defects—and to drive adoption of secure-by-design practices. She noted that nearly 200 vendors have signed CISA’s voluntary Secure by Design pledge and urged buyers to leverage procurement power, supported by newly published CISA guidance, to demand MFA, fewer default passwords, pre-release testing, and secure code by default.