Tech Companies Promise 'Secure by Design' Products

At RSA Conference 2024, CISA advanced its Secure by Design initiative with over 60 vendors pledging to prioritize security throughout the product lifecycle, focusing on goals like multifactor authentication, eliminating default passwords, reducing vulnerability classes, boosting patch adoption, formal VDPs, timely CVE transparency, and enabling customer intrusion evidence collection. CISA provided a self-attestation framework and repository to support secure development practices, with signatories including major vendors such as AWS, Cisco, Google, Microsoft, and Palo Alto Networks. The effort aims to shift security responsibility from end users to manufacturers.