As outlined in the Cybersecurity and Infrastructure Security Agency’s (CISA’s) Secure by Design initiative, software manufacturers should ensure that security is a core consideration from the onset of software development and throughout the entirety of the development lifecycle.
This voluntary guidance provides an overview of product security bad practices that are considered exceptionally risky, particularly for software manufacturers who produce software used in service of critical infrastructure or national critical functions (NCFs). This guidance also provides recommendations for software manufacturers to mitigate these risks.
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Related:
- HP Enterprise let Russia review the Pentagon’s security software
October 5, 2017
Last year, Hewlett Packard Enterprise (HPE) allowed a Russian defense agency to analyze the source code of a cybersecurity software used by the Pentagon, Reuters reports. The software, a product called ArcSight, is an important piece of cyber defense for the Army, Air Force and Navy and works by alerting users to suspicious activity — such as a ...
- How cyber impacts the full spectrum of terror threats
September 27, 2017
Despite the immediate logistical demands of three catastrophic hurricanes in the last two months and various geopolitical flashpoints, cybersecurity remains a key issue and very much on the minds of top federal defenders. “There is no longer a ‘home game’ and an ‘away game,'” for homeland security, DHS Acting Secretary Elaine Duke said at a Sept. ...
- Security experts: Iran-backed hackers targeting U.S. and Saudi Arabia
September 21, 2017
Cybersecurity firm FireEye has identified a new group of hackers, known as APT33, that it says has been working on behalf of the Iranian government since 2013. The group has “potential destructive capabilities,” FireEye warned. “The campaigns that were laid out were not just aligned with the Iranian government but with the Iranian military,” said Stuart ...
- Federal CISOs want more education and training to help boost incident response
September 13, 2017
Federal CISOs agree that investment in workforce training and education is the key to increasing incident response capabilities. If budgets weren’t an issue, Department of Homeland Security CISO Jeffrey Eisensmith said during a panel on CISO priorities for 2018 at the Sept. 13 Billington Cybersecurity Summit in Washington, D.C., he would put a “significant investment in ...
- connect:ID 2018 reveals exciting new plans to put next-generation identity solutions in the spotlight
September 12, 2017
connect:ID will be held April 30 – May 2, 2018 at the Walter E. Washington Convention Center, Washington, DC. A rapidly expanding event, connect:ID is expected to attract 1,300 identity professionals and 100+ industry and government exhibitors. This year, connect:ID will introduce a new Start-up Zone, where young identity businesses can gain vital exposure to high-level buyers and ...
- Russian cybersecurity firm Kaspersky Lab a ‘danger’ to US security, senator warns
September 5, 2017
Prominent cybersecurity firm Kaspersky Lab poses a danger to U.S. security, warns Sen. Jeanne Shaheen, D-N.H., who is pushing to prohibit the federal government from using the Moscow-based company’s products. In a New York Times column, Shaheen alleges that the company has “extensive” ties to Russian intelligence, noting that the firm’s founder Eugene Kaspersky graduated from the ...