CISA sees elimination of ‘bad practices’ as next secure-by-design step

CISA announced progress on its secure-by-design initiative with more than 230 vendor commitments and, together with the FBI, published a Product Security Bad Practices guidance to draw attention to risky software-building behaviors—such as default passwords, memory-unsafe languages, SQL/OS command injection via user input, lack of MFA, and poor CVE disclosure—encouraging manufacturers to bake security in by default and prioritize fixes like memory-safe languages; the guidance is posted for public comment until Dec. 2.