CISA’s security-by-design initiative is at risk: Here’s a path forward

As companies across the globe increasingly utilize technology to conduct business and store data, a powerful tool has emerged in the form of the Cybersecurity and Infrastructure Security Agency (CISA’s) security-by-design initiative. Under this initiative, organizations have sought to preemptively institute security measures and practices into their operations to identify and prevent potential cyber threats. While this approach can provide heightened security, it is now at risk of stagnation due to a lack of adoption and implementation. In order to ensure that the security-by-design approach is properly adopted and maintained, CISA and all stakeholders must take collective action.

First and foremost, organizations must be willing to commit their time and resources to security-by-design. This requires investing in training and certification for staff, and hiring personnel with specific security-by-design expertise. Additionally, companies should create standard operating procedures and policy documents to assist individuals in understanding their cyber security responsibilities. Finally, organizations must have a clear and comprehensive understanding of their business environment and any potential threats. By proactively looking for and responding to problems, organizations can further bolster their security-by-design framework.

The success of the security-by-design initiative also depends on robust regulations and enforcement measures. Governments must update and enforce relevant cyber security laws and regulations, while developing new ones when necessary. Standards such as ISO/IEC 27001 and NIST 800-53 can provide structures and frameworks for organizations to build robust security-by-design approaches. Additionally, organizations should regularly assess their risk and carry out security audits to ensure that their systems and networks are properly secured.

In addition to enforcement measures, CISA must also provide development and financial support to ensure that organizations are able to achieve and maintain a secure environment. CISA must make available a suite of resources specifically designed to increase awareness and understanding of security-by-design initiatives. Moreover, organizations should be provided with funds for training and resources which can, in turn, help them ensure their systems remain secure.

Finally, all stakeholders should join forces to work towards building a resilient security-by-design environment. Collaboration between organizations and government agencies should be encouraged, and international standards and norms should be established in order to protect both companies and the public. Government agencies should also provide support in the form of education, workshops, and conferences in order to further develop security-by-design initiatives.

CISA’s security-by-design initiative has the potential to significantly improve organizations’ cyber security, if adopted and implemented properly. To this end, it is important that all stakeholders take collective action and invest in the resources necessary to adequately enact security-by-design principles. Only through collective action and a commitment to security-by-design initiatives can organizations effectively protect their systems from malicious actors.