Many software manufacturers and service providers deploy software and configuration updates as part of their service offerings. These updates may enhance features and/or address security vulnerabilities to provide benefits and security to customers.
However, software and the systems that deploy software are highly complex and continually evolving, making it challenging to deploy secure updates. It is critical for all software manufacturers to implement a safe software deployment program supported by verified processes, including robust testing and measurements. The program should support and enhance both the security and quality of the product and deployment environment. This guide, authored by the Cybersecurity and Infrastructure Security Agency (CISA) and partners, encourages software manufacturers to establish a safe software deployment program as part of their software development lifecycle (SDLC).
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Related:
- The US government is building an AI sandbox to tackle cybercrime
January 10, 2023
A joint effort between the Science and Technology Directorate (S&T) – housed within the Department of Homeland Security (DHS) – and the Cybersecurity and Infrastructure Security Agency (CISA), an AI sandbox will be designed for researchers to collaborate and test analytical approaches and techniques in combating cyber threats. CISA’s Advanced Analytics Platform for Machine Learning (CAP-M) ...
- A UN committee is struggling to define what cybercrime is in upcoming treaty
January 10, 2023
A United Nations committee – whose members include delegates from the U.S., China and Russia — is meeting throughout this week and next to continue negotiations for a new international cybercrime treaty. Why it matters: The finished UN cybercrime treaty will jumpstart a wave of new laws around the world based on the agreed-upon principles in ...
- Russian troll farms didn’t sway voters in 2016 election
January 9, 2023
A new in-depth study has concluded that the Russian government’s efforts to deploy troll farms on Twitter to sway the 2016 election did not have any measurable impact on the outcome of that race. The U.S. government has been largely united in its assessment that the Kremlin attempted to use online proxies and false internet personas ...
- Iowa’s largest city cancels classes due to cyber attack
January 9, 2023
Iowa’s largest school district cancelled classes for Tuesday after determining there was a cyber attack on its technology network. Des Moines Public Schools announced Monday that classes would be cancelled for its 33,000 students after being “alerted to a cyber security incident on its technology network.” The district said in a news release that it took its ...
- US Supremes deny Pegasus spyware maker’s immunity claim
January 9, 2023
The US Supreme Court has quashed spyware maker NSO Group’s argument that it cannot be held legally responsible for using WhatsApp technology to deploy its Pegasus snoop-ware on users’ phones. Facebook and its WhatsApp subsidiary sued the notorious Isreal-based software company in 2019, alleging that NSO exploited a zero-day bug in WhatsApp to remotely drop Pegasus ...
- New York Adopts Law Protecting Power Grid from Cyber Attacks
January 4, 2023
New York Gov. Kathy Hochul signed legislation to create cybersecurity protections for the state’s energy grid. The legislation (designated A.3904B/S.5579A) will require utilities to prepare for cyberattacks in their annual emergency response plans, just as they would for storm or other hazards. The new protections also give the Public Service Commission enhanced auditing powers to ensure ...