Secure by design

to take, Dennis, we're going to take a short break.

And when we come back, I want to talk a little bit about Secure by Design and then kind of talk about, you know, we're three quarters of the way through 2026 now.

And kind of talk about what you think is coming up in 2027.

Right.

And this is a challenge we see.

So the goal should not be to slow innovation, but rather to adapt security by design approaches.

So to build security directly into innovation.

such as security, governance, compliance, and AI.

Most of the attacks targeted a small number of vulnerabilities.

CISA says continuing its Secure by Design initiative should help secure against easy targeting and insecure software in the long run.

Researchers from VulnCheck have discovered two more backdoors in ZBT home routers' firmware.

One, named DarkLantern, listens to incoming network packets for commands, while the other, SpeakingStone, phones home to a preset domain at regular intervals.

Awesome.

Two, two more questions and then I wanna pivot, but how does CI Fortify fit into the broader secure by design thinking? And if you could wave a magic wand and ask, uh, an OT, a- a- any new OT product, now the challenge is many are legacy products that have been around forever, what's the one thing you'd like to see them fix? So two, two, two biggies there.

Okay.

So I, I will say I, I started the secure by design specifically for OT work at CISA.

For OT.

Yeah, you led that effort, right?

I did, and I, I still do.

And so there is a lot of secure by design that kind, kind of gets snuck under the coat of, uh, CI Fortify sometimes.

Yeah, no, absolutely.

I mean, look, hopefully folks are somewhat familiar with the whole secure by design movement, but we really leaned into this.

And so- I would highly recommend that your listeners just check out the website on CISA.gov. There's a whole bunch of really interesting technical information around the Secure by Design campaign.

What does it actually mean? How do you build secure products from a supplier-vendor perspective? We actually did this whole pledge.

And we started out, we did it at RSA in 2024.

It led to compliance box checking, not actually operational risk reduction.

So I'm not a huge fan of regulation.

But I think that the EU Cyber Resilience Act is actually pretty interesting because much of what it asks vendors to do aligns with the secure by design principles that we've been putting out for a while now we've been talking about.

So

I have a question like, you know, maybe because we just, you know, thinking about secure by design, but, you know, you also have to run your patches regardless of who writes it.

AI, human, combo of both.

You have to run it through your secure by design best practices, right? right? You have to go, you have to look, you know, you have to check the, whatever, you know, your normal code checking, and maybe it's enhanced by AI.

You should still be doing that.

Did you take that into consideration for your scenarios?

And I think to the point that you're driving toward, that I think is a really strong example of what good, secure design outcomes can produce, is you go back to, I think it was maybe March or April, when Firefox released a pretty big patch set, something like 200 plus patches.

But they talked about in that same release, how there were a very large hundreds of vulnerabilities that did not need to be patched because of the design and architecture of the software that prevented those from ever becoming exploitable.

He also worked at CISA and was the head of security, the CISO or CISO at Yahoo at one point.

And he's also led a lot of great work around this notion of secure by design.

That initiative is something that he has been one of the kind of founders of.

And he's just a great guy.

I'll probably do another newsletter.

coming up soon, so go check that out.

And then, you know, my main passion is around Secure by Design.

I've been doing a bunch of consulting for organizations to help them think through their security of their systems.