Kirk Lawrence, program manager for the Secure by Design initiative at the Cybersecurity and Infrastructure Security Agency, said implementing Secure by Design principles is the first step in building a threat-resilient digital environment, Nextgov/FCW reported Friday.
“It doesn’t mean that your place can’t get broken into, that someone can’t come steal your stuff, but they [have] to work a little harder now to have a different set of skills,” Lawrence said. “Secure by Design is not the end of risk. It’s the start of resilience.”
Gaining Executive Buy-In for Secure by Design
The CISA official also cited the agency’s effort to highlight Secure by Design’s business benefits. He said the key mission is to develop talking points for a tech project owner to discuss the value of Secure by Design with C-level executives to gain the latter’s support.
“One of the key principles that we’ve advocated since the beginning is that it’s not going to happen unless you have executive buy-in, which is one of the very first steps to having effective Secure by Design,” Lawrence said at a cybersecurity conference.
CISA’s Secure by Design Initiatives
In May 2024, CISA and its counterparts in Australia, New Zealand, Canada and the U.K. issued guidance on Secure by Design considerations that manufacturers and organizations could use to inform their decisions when purchasing digital products and services.
CISA also announced last year that 68 software manufacturers and technology firms participated in the agency’s Secure by Design pledge.
In August 2024, CISA and the FBI released a guide to help customers ensure that the Secure by Design concept is a core consideration in software procurement.
