Secure by Design

Links

A curated list of guidance, talks, and research on secure-by-design software.

  • CISA: Secure by Design

    cisa.gov

    CISA's home for its Secure by Design initiative. It explains what secure by design and secure by default mean, and collects the joint international guide to principles and approaches, speeches, and related resources.

  • Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem

    ic3.gov

    A CISA and FBI guide (PDF) for organizations that buy software. It distinguishes enterprise security from product security and gives questions to ask software manufacturers before, during and after procurement, covering authentication, eliminating classes of vulnerability, security logs, software supply chain security, and vulnerability disclosure and CVE reporting.

  • The Case for Memory Safe Roadmaps

    cisa.gov

    CISA guidance, co-authored with the NSA, the FBI and the cybersecurity authorities of Australia, Canada, the United Kingdom and New Zealand, on how software manufacturers can eliminate memory safety vulnerabilities by moving to memory safe programming languages. It sets out steps for creating and publishing a memory safe roadmap, and the page also links a companion study of memory safety in critical open source projects.