From CISA to Starting Up: Shifting Secure by Design at Scale

From CISA to Starting Up: Shifting Secure by Design at Scale

Speakers: Jack Cable, CEO and co-founder, Corridor

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=_Oo0hdC8fZk

Overview

Jack Cable, CEO and co-founder of Corridor, delivered a compelling talk at BSides NYC, tracing his journey from leading the "Secure by Design" initiative at the Cybersecurity and Infrastructure Security Agency (CISA) to founding a startup focused on securing AI coding. The presentation dissected the persistent challenge of preventable software vulnerabilities, arguing that despite decades of awareness, fundamental security flaws continue to plague the digital landscape. Cable emphasized the critical need to shift the burden of cybersecurity responsibility from end-users to software vendors, advocating for a proactive, design-centric approach to security.

The talk highlighted the successes and limitations of governmental efforts like CISA's Secure by Design pledge, while simultaneously exploring the transformative, yet perilous, impact of artificial intelligence on software development. Cable posited that while AI coding tools accelerate innovation, they also introduce familiar vulnerabilities at an alarming rate. His current venture, Corridor, aims to leverage this technological shift to embed security intrinsically into the development process, potentially offering a path to finally overcome long-standing security challenges.

This discussion is particularly pertinent in an era where cyberattacks frequently exploit well-known weaknesses, and the rapid adoption of AI coding tools promises both unprecedented efficiency and magnified risks. Cable's unique perspective, spanning both public sector policy and private sector innovation, offers valuable insights into the systemic issues hindering software security and potential avenues for industry-wide improvement.

Background

▶ Watch: Speaker introduction and journey to secure by design (0:00)

The pervasive nature of preventable security weaknesses forms the central thesis of Cable's argument. He highlighted that despite decades of research and documented solutions, fundamental vulnerabilities like SQL injections and memory safety errors continue to dominate the threat landscape. A comparison of the OWASP Top 10 in 2017 and 2021 reveals minimal change, underscoring the stagnation in addressing these root causes. Similarly, a 2007 MITRE paper on "unforgivable vulnerabilities" presented findings that, alarmingly, remain relevant today, indicating a multi-decade failure to eradicate these common flaws.

Specific examples illustrate this systemic problem. Memory safety issues, such as buffer overflows, were first documented in the 1990s, yet remain among the most commonly exploited vulnerabilities. SQL injections, too, have a long history, with MySQL introducing parameterized queries in 2004 – a fundamental prevention mechanism – making their continued prevalence inexcusable. The infamous MoveIT hack, which compromised file-sharing software and led to hundreds of breaches across various organizations, was attributed to a SQL injection vulnerability, a flaw known and preventable for over 20 years. Moreover, campaigns like Volt Typhoon, targeting network edge devices, often exploit preventable software vulnerabilities or insecure default configurations, demonstrating that sophisticated state-sponsored attacks frequently leverage basic, vendor-introduced weaknesses.

Recognizing this persistent problem, CISA launched its Secure by Design initiative in 2023. Aligned with the White House's National Cyber Strategy, the initiative aimed to shift the burden of cybersecurity responsibility from end-users, who are often least capable of addressing complex security issues, to software vendors, who are best positioned to build secure products from the outset. This involved publishing guidance in collaboration with 13 other countries across three continents and establishing the Secure by Design pledge. Over 300 companies signed this pledge, committing to seven basic product security improvements, including increasing multi-factor authentication (MFA) adoption and reducing default passwords and entire classes of vulnerabilities. Despite the seemingly basic nature of these commitments, securing them required significant effort in consensus building, highlighting the ingrained resistance to prioritizing product security.

Key Findings

▶ Watch: The persistent problem: old vulnerabilities still exploited (2:00)

Cable's talk unveiled several critical findings regarding the state of software security and the effectiveness of current initiatives. Firstly, the enduring prevalence of known, preventable vulnerabilities stands out as a primary concern. Data from MITRE on "known exploited vulnerabilities" consistently shows memory safety errors (e.g., use after free, buffer overflow, out-of-bounds issues) as top root causes, despite the existence of memory-safe programming languages for decades. Similarly, SQL injection vulnerabilities, preventable since 2004 with techniques like parameterized queries, continue to be a major vector for attacks, as evidenced by the MoveIT hack. This highlights a critical disconnect between available technical solutions and their widespread implementation.

Secondly, while CISA's Secure by Design pledge garnered significant attention, with over 300 companies committing to basic security improvements, its practical impact reveals limitations of purely voluntary action. Major cloud providers like Google, Amazon, and Microsoft did move towards requiring MFA, and some companies published statistics on patch uptake or vulnerability rates. However, Cable noted that only around 40 of the 300+ signatories had published their promised progress reports as of a few weeks prior to the talk. This suggests that while the pledge built consensus, a substantial portion of companies lacked sufficient incentives to follow through on their commitments, pointing to a fundamental market failure where businesses are not adequately incentivized to produce more secure code.

Thirdly, the talk identified AI coding as a transformative force with a dual impact on security. AI coding tools have seen rapid adoption, with 84% of developers now using them and 30-40% of companies encouraging their use. This acceleration in development speed, however, comes with a significant security cost. Benchmarks like Backbench indicate that even advanced models like GPT-5 introduce vulnerabilities anywhere from 20% to 40% of the time. These aren't just novel AI-specific flaws; they are often the same basic vulnerabilities (SQL injections, hardcoded credentials, memory safety issues) that human developers have introduced for decades. This implies that while AI can amplify productivity, it also amplifies the potential for insecure code generation.

Finally, Cable emphasized the immense opportunity presented by AI to fundamentally shift security practices. He argued that AI could move security left, making it possible to prevent certain classes of vulnerabilities at the source, rather than relying solely on human developers as the final security layer. This paradigm shift, where AI tools themselves are designed to write secure code, could potentially relegate issues like SQL injection to the past. This perspective forms the core premise of his new company, Corridor, aiming to ensure that AI-generated software is "secure by design" and enterprise-ready, tackling both basic and more contextual vulnerabilities like authorization flaws.

Technical Deep Dive

▶ Watch: CISA's Secure by Design initiative and global pledge (4:00)

The technical core of Cable's discussion revolved around the persistent problem of memory safety and SQL injection vulnerabilities, and the emerging challenges and opportunities presented by AI coding.

Memory Safety Errors continue to be a dominant root cause for exploited vulnerabilities. Cable presented a compelling graph from Google illustrating the impact of shifting to memory-safe languages in Android development. As Google progressively lowered the amount of new code written in memory-unsafe languages (like C/C++) and increased the use of languages like Kotlin, they observed a 50% reduction in the overall rate of memory safety vulnerabilities. Crucially, this reduction occurred even with existing legacy code still in place, because the majority of exploited vulnerabilities were found in new code. This demonstrates that prioritizing memory-safe languages for new development can yield significant, immediate security benefits. This trend is not isolated to Google; Microsoft is actively rewriting parts of the Windows kernel in Rust, and similar efforts are underway for the Linux kernel, with Amazon also making substantial contributions in this area. Cable's unequivocal recommendation for new product development is to avoid C or C++ in favor of memory-safe alternatives.

SQL Injection Vulnerabilities represent another class of well-understood flaws that remain stubbornly prevalent. Despite the availability of effective prevention mechanisms, such as parameterized queries (introduced by MySQL in 2004), for over two decades, software companies continue to introduce these bugs. Google, for instance, has demonstrated how to prevent SQL injections at scale by implementing type-level safety that makes it technically impossible for developers to include user input directly as part of a database query string. This technical solution highlights that the problem is not a lack of knowledge or capability, but rather a business incentive problem, where the majority of companies lack sufficient motivation to invest in these preventative measures.

The advent of AI coding tools introduces a new dimension to these technical challenges. While these tools significantly accelerate development, they are prone to generating code with existing, known vulnerabilities. Benchmarks like Backbench reveal that even sophisticated models like GPT-5 introduce vulnerabilities in 20-40% of generated code. These vulnerabilities span both "basic flaws" (e.g., SQL injections, memory safety issues, hardcoded credentials) and more "contextual ones" (e.g., authorization flaws, business logic errors). Cable believes that basic flaws will likely be mitigated at the model level within a few years, but contextual vulnerabilities will require more sophisticated solutions. This is where Corridor focuses its efforts: ensuring AI-generated code is inherently more secure.

The discussion also touched upon the legacy code problem. While new development can adopt secure practices, the vast existing codebase in memory-unsafe languages presents a significant challenge. Cable mentioned the DARPA "Tractor" initiative (Translating All C/C++ to Rust), which funds research into tools for automatically translating legacy code into memory-safe languages. This suggests that a multi-pronged approach, addressing both new code generation and legacy code remediation, is essential for achieving a truly secure software ecosystem. Corridor's focus on "new code going forward" aims to prevent the accumulation of new technical debt while acknowledging the importance of legacy system improvements.

Demo / Proof of Concept

▶ Watch: Assessing the Secure by Design pledge's impact and critics (6:00)

While the talk didn't include a live demonstration of Corridor's product, Jack Cable did provide insight into its purpose and upcoming availability. Corridor, founded in January, is focused on securing AI coding by ensuring that AI-generated software is "more secure by design." Cable mentioned that the company had grown to eight employees and was preparing for a public launch of their product the following Thursday. The core idea is to leverage the capabilities of AI to prevent vulnerabilities at the source, rather than relying on human developers to catch them downstream. This approach aims to address the critical gap identified by benchmarks like Backbench, where AI models frequently introduce security flaws, and to make AI-powered development suitable for enterprise-ready applications by embedding security as a core tenet.

Defensive Implications

▶ Watch: MITER's top root causes of exploited vulnerabilities (7:00)

The insights from Jack Cable's talk carry significant defensive implications for various stakeholders in the software ecosystem.

For Software Vendors:

The primary implication is a strong call to action for prioritizing secure by design principles from the very inception of product development. Vendors should:

• Embrace Memory-Safe Languages: For all new product development, actively avoid memory-unsafe languages like C and C++ in favor of modern alternatives such as Rust or Kotlin. Google's success with Android demonstrates the tangible security benefits (50% reduction in memory safety vulnerabilities) of this shift.
• Implement Known Preventions: Proactively integrate technical controls for well-understood vulnerabilities. This includes mandating parameterized queries for all database interactions to prevent SQL injections, and adopting other architectural patterns that disallow user input in unsafe contexts.
• Adopt Secure Defaults: Follow through on commitments like CISA's Secure by Design pledge by implementing security features such as MFA as a default for all user accounts and eliminating common insecure defaults.
• Invest in AI Coding Security: As AI coding tools become ubiquitous, vendors must ensure that these tools generate secure code. This involves working with model providers to improve benchmarks and integrating security analysis directly into the AI development pipeline, moving beyond basic flaw detection to address contextual vulnerabilities.
• Transparency and Accountability: Go beyond signing pledges and actively publish progress reports detailing security improvements, patch uptake rates, and efforts to reduce vulnerability classes. This transparency can help distinguish committed vendors and build trust.

For Organizations Acquiring and Using Software:

Organizations are empowered to demand higher security standards from their software suppliers:

• Demand Security Transparency: Actively inquire about vendors' secure by design practices, their use of memory-safe languages, and their strategies for preventing common vulnerabilities. Don't settle for vague "military-grade encryption" claims.
• Articulate Clear Requirements: Reference industry best practices and specific demands, such as those outlined in letters from major corporate buyers like JP Morgan Chase (Pat Gelsinger's letter), to push vendors towards concrete security improvements.
• Recognize Limitations of Voluntary Action: Understand that voluntary pledges may not always translate into action. Factor a vendor's actual track record and public reporting into procurement decisions.

For Individual Developers and Development Teams:

Developers play a crucial role in building secure software:

• Enhance Security Knowledge: Given the lack of required security courses in many computer science curricula, developers must proactively educate themselves on secure coding practices, common vulnerabilities, and defensive techniques.
• Responsible AI Tool Use: While AI coding tools can boost productivity, developers must remain vigilant. They should understand the limitations of these tools in generating secure code and treat AI-generated code with scrutiny, performing thorough security reviews and testing.
• Advocate for Secure Practices: Push for the adoption of secure by design principles, memory-safe languages, and robust security tooling within their organizations.

For Policy Makers and the Industry at Large:

Systemic changes are needed to address market failures:

• Consider Software Liability: Explore the implementation of software liability frameworks, similar to those in other industries (e.g., product liability for toasters). Holding software vendors legally accountable for vulnerabilities that lead to harm could provide a powerful incentive for prioritizing security.
• Promote Information Transparency: Encourage greater transparency in product security information, allowing buyers to make informed decisions based on concrete security measures rather than marketing claims.
• Invest in Security Education: Advocate for fundamental changes in computer science education to make security a mandatory and integral part of the curriculum for future software engineers.
• Support Research and Open Source Tools: Initiatives like DARPA's "Tractor" project, focused on translating legacy code to memory-safe languages, should be supported to address the enormous challenge of existing vulnerable codebases.

Ultimately, the defensive posture must shift from reactive patching and incident response to proactive prevention, driven by strong incentives, robust technical practices, and a culture of security embedded throughout the software development lifecycle.

Key Takeaways

• Persistent Vulnerabilities: Despite decades of awareness and known solutions, fundamental security flaws like memory safety errors (buffer overflows, use after free) and SQL injections remain the most commonly exploited vulnerabilities, indicating a systemic failure in software development practices.
• Limitations of Voluntary Action: While initiatives like CISA's Secure by Design pledge can build consensus and encourage some improvements (e.g., MFA adoption by cloud providers), purely voluntary commitments often fall short, with a significant number of companies failing to follow through on transparency and reporting.
• AI's Dual Impact: AI coding tools are rapidly increasing developer productivity but simultaneously introduce the same types of vulnerabilities (20-40% of the time, per Backbench benchmarks) that human developers have struggled with, amplifying both innovation and risk.
• Secure by Design is Paramount: The most effective way to improve software security is to embed it from the start. This includes adopting memory-safe languages for new code (e.g., Kotlin/Rust significantly reducing vulnerabilities), implementing robust technical controls for common flaws (e.g., parameterized queries), and making security a non-negotiable aspect of development.
• Need for Stronger Incentives: The current market often lacks sufficient incentives for companies to produce more secure software. This necessitates exploring mechanisms like software liability and increased transparency requirements to shift the burden and cost of insecurity onto vendors.
• Opportunity with AI: Despite the immediate security challenges, AI presents a unique opportunity to fundamentally change the security landscape by potentially preventing entire classes of vulnerabilities at the source, reducing the reliance on human developers as the final security gate.

About the Speaker(s)

Jack Cable is the CEO and co-founder of Corridor, a company dedicated to securing AI coding. His journey into cybersecurity began early, through bug bounty programs in high school, where he quickly rose to become one of the top 100 bug bounty hunters of all time on HackerOne after discovering a critical vulnerability in a cryptocurrency website. He pursued a degree in computer science at Stanford University, further solidifying his technical foundation.

Prior to co-founding Corridor, Jack served in the government at the Cybersecurity and Infrastructure Security Agency (CISA). There, he played a pivotal role in leading the Secure by Design initiative, a significant effort to encourage technology companies to prioritize product security and shift the burden of cybersecurity responsibility away from end-users. His work at CISA also included building tooling to help election officials understand and address vulnerabilities ahead of the 2020 election. Jack co-founded Corridor in January, driven by the premise of ensuring that AI-generated software is inherently more secure, drawing on his extensive experience in both security research and policy. He emphasizes qualities like persistence, speed of execution, and adaptability as crucial for success in both government and the fast-paced startup world.