Unsafe At Any Speed: CISA's Plan to Foster Tech Ecosystem Security
summary
CISA outlines a concrete plan: a published April white paper, an RFI on open-source security and memory-safe rewrites, and a Defcon workshop to co-design a second white paper that defines evidence of secure by design practices. Key technical asks include adopting memory-safe languages (claiming roughly two-thirds of memory-unsafe vulnerabilities are eliminable), publishing software bill of materials, enabling MFA on by default, reforming CVE/CWE tagging, and leveraging Cyber Incident Reporting for CI Act data.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:26Learning from other industries
- 4:25The case for secure by design
- 8:21Principles of secure products
- 11:04Design and default security
- 14:04Actionable security examples
- 16:52Default settings and user burden
- 19:30Ecosystem-wide collaboration
- 22:00Economic perspective on security
- 25:09CISA strategy and roadmap
- 27:54Initiatives and announcements
- 31:02Call to action for the community
- 33:12Q&A session
related talks
31mThe Product Security Imperative: Lessons from CISA
20m"Making Open Source Secure by Design"
27mDriving Policy To Secure the Open Source Ecosystem
15mKeynote: Government's Continuing Path Contributing Towards a Secure Open Source Ecosystem
40mHow CISA Is Charting a Path Toward Defensible Infrastructure
52mCyber Informed Engineering: Getting Engineers to Live Security-by-Design
52mData-Driven Cyber Policy: From Dream to Reality
51mNo More Secrets in Cybersecurity: Implementing ‘Radical Transparency’