Secure by Design at CERT

A troubling development in the cyber realm is society’s acceptance of the expectation that all software is released with defects that must be dealt with through patches, most of which follow exploitation of weaknesses in the software by nefarious actors. In a recent address to the nation from Carnegie Mellon University, Jen Easterly, director of the Cybersecurity Infrastructure Security Agency (CISA), noted that this “normalization of deviance” has meant that we are accepting software products that fail to approach our own standards for safety. In her address, Easterly cited work by Diane Vaughn, who wrote about the 1986 Challenger disaster and the decisions leading up to it. Vaughan’s book characterized an environment in which people become so accustomed to a deviant behavior that they don't consider it as deviant. Unfortunately, as Easterly noted, we have become inured to ransomware and cyber attacks, so she called upon technology and software producers to shift left and incorporate security earlier in the development lifecycle to ensure that robust security is a feature of every product that the public, military, and government uses.   A troubling development in the cyber realm is society’s acceptance of the expectation that all software is released with defects that must be dealt with through patches, most of which follow exploitation of weaknesses in the software by nefarious actors. In a recent address to the nation from Carnegie Mellon University, Jen Easterly, director of the Cybersecurity Infrastructure Security Agency (CISA), noted that this “normalization of deviance” has meant that we are accepting software products that fail to approach our own standards for safety. In her address, Easterly cited work by Diane Vaughan, who wrote about the 1986 Challenger disaster and the decisions leading up to it. Vaughan’s book characterized an environment in which people become so accustomed to a deviant behavior that they don't consider it as deviant. Unfortunately, as Easterly noted, we have become inured to ransomware and cyber attacks, so she called upon technology and software producers to shift left and incorporate security earlier in the development lifecycle to ensure that robust security is a feature of every product that the public, military, and government uses.   Within days of Easterly’s speech, the White House released the national cybersecurity strategy, which, among other things, calls for more expansive regulation to shift responsibility for secure software products and services onto technology manufacturers who have traditionally relied on users to configure security into their products. This notion of secure by design has been a long-standing tenet of all the work that we undertake at the SEI and, in particular, our CERT Division, which specializes in cybersecurity engineering and resilience research and development. In this post, I will highlight our continued and longstanding efforts to ensure security by design in fielded software.