RSAC Tech Talk - Secure by Design by Lauren Zabierek

Secure by Design: Shifting the Burden of Cybersecurity Responsibility

Speakers: Lauren Zabierek, Senior Advisor, Cybersecurity Division, CISA

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=lpDohekqcRM

Overview

In a pivotal address at RSAC 2024, Lauren Zabierek, a Senior Advisor within the Cybersecurity Division at CISA (Cybersecurity Infrastructure Security Agency), unveiled the agency's ambitious "Secure by Design" initiative. This talk meticulously articulated a fundamental paradigm shift in cybersecurity, aiming to reallocate the immense burden of digital defense from the end-users and victim organizations to the technology manufacturers themselves. Zabierek underscored the critical importance of this shift, framing it not just as a technical imperative but as a national security mandate, directly echoing sentiments expressed by CISA Director Jen Easterly in her congressional testimony.

The core premise of Secure by Design is to embed security as a foundational element throughout the product development lifecycle, rather than treating it as a retrofitted afterthought. This initiative is CISA's direct response to the prevalent issue where sophisticated adversaries, such as the PRC, exploit known and often easily preventable product defects, making it "easy for them" to compromise critical infrastructure. By advocating for a transformation in a "$40 trillion industry," CISA seeks to cultivate a cybersecurity ecosystem where products are inherently resilient, thereby mitigating the pervasive "national security delta" created by the current unsustainable model of reactive defense.

This talk is particularly significant because it challenges long-accepted industry norms that have inadvertently placed the responsibility for security on those least equipped to manage it. Zabierek passionately argued for a future where technology is inherently safe, akin to the safety standards now commonplace in the automobile industry. This vision, driven by CISA, aims to reduce the financial and operational costs currently borne by customers and instead incentivize manufacturers to prioritize security from conception, ultimately fostering a more secure digital landscape for all.

Background

▶ Watch: CISA Director's testimony: "We've made it easy for them" (0:28)

The current cybersecurity landscape is characterized by a deeply entrenched and unsustainable model of responsibility. As Zabierek highlighted, the prevailing norm places the burden of staying cyber safe on individuals and organizations often least equipped to understand the evolving threat landscape, respond effectively with adequate personnel and processes, or afford the necessary technologies to counter sophisticated adversaries. This dynamic leads to a reactive cycle of blame, where victims are often faulted for not patching quickly enough, not deploying Multi-Factor Authentication (MFA), or failing to implement complex hardening guides. Yet, the underlying issue—products shipped with insecure defaults or inherent design flaws—is rarely addressed at its source.

This problem is not new. Zabierek referenced historical reports that underscore the persistent nature of these challenges. In 1972, the U.S. Air Force's Anderson Report presciently stated that "there's little chance that products can be made secure by retrofitting security products on afterwards." Over five decades later, this observation remains acutely relevant. The industry continues to grapple with "unforgivable vulnerabilities," a term coined by Steve Christie of MITRE in 2007. These include well-known flaws like cross-site scripting (XSS) and SQL injection, vulnerabilities for which known fixes have existed for years, yet they continue to be introduced into new products.

Further illustrating this lack of progress, Zabierek pointed to MITRE's periodically updated CWE Top 25 list, which enumerates the "most stubborn weaknesses." This list consistently features common vulnerabilities with readily available mitigations, indicating a systemic failure by product developers to prioritize security during the design and development phases. The "intentionally messy slide" presented by Zabierek visually represented this stagnation, showing that despite decades of awareness and available solutions, the industry has largely failed to embed security proactively. This historical context reveals a deeply ingrained cultural and economic inertia, where the costs of insecurity are externalized to customers, creating a "national security delta" where collective resilience is undermined by individual product weaknesses. CISA's Secure by Design initiative is a direct attempt to break this cycle, leveraging the mandate of the National Cybersecurity Strategy to shift responsibility to those "most capable of actually addressing those threats."

Key Findings

▶ Watch: National Cybersecurity Strategy shifts security burden to manufacturers (2:08)

CISA's Secure by Design initiative is firmly rooted in the National Cybersecurity Strategy, which prescribes two fundamental shifts for the nation, one of which is to transfer the primary burden of cybersecurity responsibility from the least equipped to the most capable. Secure by Design operationalizes this shift by articulating three core principles, primarily aimed at business leaders rather than individual developers, recognizing that strategic decisions drive organizational change.

The first principle is that businesses should own the security outcomes of their customers. This moves beyond merely providing a product to taking accountability for how that product performs in a secure manner throughout its lifecycle. It implies a deeper commitment to customer safety and data integrity, acknowledging that a product's security directly impacts its users' operational resilience and trust. The second principle mandates that businesses should embrace radical transparency and accountability with their products. This calls for openness about security practices, vulnerabilities, and incident response, fostering an environment where customers can make informed decisions and hold manufacturers responsible. This transparency extends to how security is integrated and maintained, moving away from opaque practices.

Finally, the third principle asserts that leaders should lead from the top, building organizational structures that facilitate secure development practices. This requires tangible investments in products, people (e.g., security training, dedicated security teams), and the right tooling. Zabierek emphasized that these principles are directed at business leaders because they possess the authority to make security a stated business goal, integrating it into the company's DNA from the outset.

A critical distinction highlighted in the talk is between Secure by Design and Secure by Default. While often conflated, they represent different, albeit complementary, aspects of product security:

• Secure by Design: This refers to technology products being fundamentally built to protect against malicious actors gaining access to data and devices. It is a strategic, upfront commitment, a "stated business goal before the design kickoff." It requires making trade-offs early in the development process and cannot be "added later." This concept is about eliminating entire classes of vulnerabilities before they are ever introduced.

• Secure by Default: This means products are shipped with secure configurations "out of the box." It implies that the most secure settings are enabled by default, requiring users to explicitly "loosen" security if less secure functionality is desired. Crucially, these secure defaults should come "without any added charges or new licenses required" and be "default in every product," simplifying security for the end-user.

Together, these two concepts form a powerful framework for transforming the industry, ensuring that security is not just an optional feature but an inherent characteristic of all technology products.

Technical Deep Dive

▶ Watch: Decades of "unforgivable" vulnerabilities persist in products (3:45)

The technical implementation of Secure by Design and Secure by Default requires a fundamental rethinking of product development and delivery. For Secure by Design, the focus is on architectural and developmental choices made at the earliest stages. Zabierek provided several concrete examples:

• Eliminating Entire Classes of Vulnerabilities: This is perhaps the most impactful aspect. Instead of patching individual instances of vulnerabilities like buffer overflows, SQL injection, or cross-site scripting (XSS), Secure by Design aims to prevent their existence entirely through secure coding practices, robust input validation frameworks, and memory-safe languages. This proactive approach drastically reduces the attack surface and the perpetual cycle of patching.
• Secure Hardware Foundations: Embedding security at the hardware level provides a trusted root of execution and isolation. This can involve hardware-backed encryption, secure boot mechanisms, trusted platform modules (TPMs), and secure enclaves that protect sensitive data and operations from software-level attacks.
• Software Bills of Material (SBOMs): SBOMs provide a comprehensive, machine-readable list of all components, libraries, and dependencies used in a software product. This transparency allows organizations to understand their supply chain risks, track known vulnerabilities (e.g., via CVEs) within components, and respond more effectively to newly discovered threats. It shifts the burden of understanding component risk from the end-user to the manufacturer who assembled the software.
• Vulnerability Disclosures with Safe Harbor: Establishing clear policies for vulnerability disclosure, coupled with safe harbor provisions, encourages security researchers to report flaws without fear of legal reprisal. This fosters a collaborative environment where vulnerabilities can be identified and remediated before they are exploited in the wild, improving overall product security.

Complementing Secure by Design, Secure by Default focuses on the user experience and ease of adoption of secure practices:

• Eliminating Default Passwords: A common attack vector, default passwords (e.g., "admin/admin") are a critical security flaw. Secure by Default products require users to set strong, unique passwords upon initial setup, or better yet, integrate with modern authentication methods.
• Enabling Single Sign-On (SSO) at No Extra Charge: SSO solutions enhance security by centralizing authentication and often enabling stronger authentication methods like MFA. Making SSO a default, free feature removes a significant barrier to adoption for businesses, reducing password sprawl and improving identity management.
• High-Quality Audit Logs at No Extra Charge: Comprehensive and tamper-resistant audit logs are crucial for detection, forensics, and incident response. Providing these logs by default, without additional licensing fees, ensures that organizations have the visibility needed to monitor their systems effectively.
• Reducing Hardening Guides, Introducing Loosening Guides: Instead of complex, multi-page hardening guides that require significant effort to implement, Secure by Default products would come pre-configured in their most secure state. Any deviation from this secure baseline would require explicit action, guided by a "loosening guide" that explains the security implications of reducing the default security posture.
• MFA Pushes for All Products: Making MFA not just available but actively encouraged or even enforced by default significantly enhances account security, protecting against credential theft.
• User Experience as Secure and Easy to Use as Possible: Security should not come at the expense of usability. Secure by Default aims to integrate security seamlessly into the user experience, making the secure path the easiest and most intuitive one.

Zabierek drew a compelling analogy to the automobile industry. In the 1950s and 60s, cars were designed for "speed and style, not safety." It took the groundbreaking work of Ralph Nader, his book "Unsafe at Any Speed," and subsequent congressional testimony to compel legislative action and establish safety standards. The result, as graphically depicted in the talk, was a dramatic plummet in "deaths per billion vehicle miles traveled" over decades, even as the population grew. This demonstrated that systemic change, driven by regulatory and public pressure, can transform an entire industry's approach to safety. CISA posits that the technology industry is at a similar inflection point, aiming to achieve a comparable reduction in "attacks and critical infrastructure outages." The core philosophical takeaway is profound: "Before a safer car could be made, we had to believe in the idea of a safer car." This belief, applied to technology, is the bedrock of Secure by Design.

Demo / Proof of Concept

▶ Watch: Defining Secure by Design and Secure by Default (5:55)

The presentation by Lauren Zabierek was a strategic and policy-focused discourse on CISA's Secure by Design initiative. It did not include a live technical demonstration or a proof of concept of a specific secure product or vulnerability exploit. The speaker utilized a diagram depicting cars and their safety evolution as an analogy to illustrate the potential for systemic change in the technology industry, rather than as a literal demo.

Defensive Implications

▶ Watch: Automobile safety as a model for secure technology (7:55)

While the Secure by Design initiative primarily targets technology manufacturers, its successful implementation carries profound implications for defenders across all sectors. The current model places an unsustainable burden on defenders, who are forced to manage an ever-increasing attack surface stemming from inherently insecure products. Zabierek detailed the "hard and soft costs" borne by customers: purchasing security products, the "single sign-on tax," staffing security teams, paying for cyber insurance, deploying complex hardening guides, and incurring immense costs for incident response (IR firms, lost executive productivity). Secure by Design aims to shift these costs "left" to manufacturers during the design stage, before products are even built.

For defenders, this shift means several critical changes:

1. Reduced Operational Overhead: When products are Secure by Default, defenders will spend less time on basic hardening, configuration, and patching of known, common vulnerabilities. This frees up valuable security resources to focus on more sophisticated threats and proactive defense strategies unique to their organization.
2. Improved Baseline Security: Products designed with security in mind will offer a higher baseline of protection, making it harder for adversaries to exploit common weaknesses. This inherently raises the bar for attackers, requiring more advanced techniques and potentially reducing the frequency and severity of incidents.
3. Enhanced Supply Chain Visibility: With SBOMs becoming standard, defenders will gain unprecedented visibility into the components of their software, enabling better risk assessment and more rapid response to zero-day vulnerabilities affecting popular libraries.
4. Stronger Procurement Practices: Defenders can leverage CISA's Secure by Design principles to influence their procurement decisions. By demanding products that adhere to these standards—explicitly asking for secure defaults, evidence of vulnerability elimination, and transparent security practices—they can drive market demand for more secure offerings.
5. Advocacy and Education: Defenders should become advocates for Secure by Design within their organizations and with their vendors. Educating internal stakeholders about the benefits of this paradigm shift can help garner support for prioritizing security in purchasing and development.
6. Focus on Strategic Defense: With manufacturers taking on more responsibility for baseline product security, defenders can pivot their efforts towards strategic threat intelligence, advanced threat hunting, and building resilient security architectures tailored to their specific risk profile, rather than constantly reacting to product deficiencies.

Ultimately, the defensive implication is a transition from a reactive, victim-blaming posture to a more proactive, systemic approach where security is a shared responsibility, with manufacturers leading the charge. This promises to create a more resilient digital infrastructure, reducing the "national security delta" and allowing defenders to operate from a position of strength rather than constant remediation.

Key Takeaways

• CISA's Secure by Design initiative aims to fundamentally shift the burden of cybersecurity responsibility from end-users and victims to technology manufacturers.
• The current model is unsustainable, leading to persistent "unforgivable vulnerabilities" and significant "hard and soft costs" for customers, creating a "national security delta."
• Secure by Design is predicated on three principles: businesses owning customer security outcomes, embracing radical transparency, and leaders driving security from the top.
• A key distinction exists between Secure by Design (security built into the product's architecture from the start) and Secure by Default (products shipped with the most secure configurations enabled out-of-the-box, without extra cost).
• Practical applications include eliminating entire classes of vulnerabilities, providing SBOMs, implementing secure hardware foundations, and offering free MFA and audit logs.
• The historical success of the automobile industry in improving safety standards serves as a compelling model for what the technology sector can achieve through collective commitment and belief in inherently safer products.

About the Speaker(s)

Lauren Zabierek is a Senior Advisor within the Cybersecurity Division at CISA, the Cybersecurity Infrastructure Security Agency. In this role, she contributes to the agency's efforts to enhance the security and resilience of the nation's critical infrastructure against cyber threats. Her work involves driving key initiatives such as Secure by Design, advocating for systemic changes in the technology industry to improve baseline cybersecurity.