Secure by Design
It's time to build cybersecurity into the design and manufacture of technology products.
Find out here what it means to be secure by design.
As America’s Cyber Defense Agency, CISA is charged with defending our nation against ever-evolving cyber threats and to understand, manage, and reduce risk to the cyber and physical infrastructure that Americans rely on every hour of every day. But, as we introduce more unsafe technology to our lives, this has become increasingly difficult.
As a nation, we have allowed a system where the cybersecurity burden is placed disproportionately on the shoulders of consumers and small organizations and away from the producers of the technology and those developing the products that increasingly run our digital lives. Americans need a new model to address the gaps in cybersecurity—a model where consumers can trust the safety and integrity of the technology that they use every day.
Government cannot solve this problem alone. Technology manufacturers must increasingly embrace their role in putting consumer safety first. Technology providers and software developers must take the first step to shift this burden by claiming ownership of their customers’ security outcomes.
Featured Content
Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default
Joint U.S. & international guide urging software manufacturers to take necessary steps to ship products that are secure-by-design and -default.
CISA Director Easterly Remarks at Carnegie Mellon University
Unsafe at Any CPU Speed: The Designed-in Dangers of Technology and What We Can Do About It
Stop Passing the Buck on Cybersecurity - Why Companies Must Build Safety Into Tech Products
By CISA Director Jen Easterly and Executive Assistant Director for Cybersecurity Eric Goldstein
CISA’s Cyber Experts Talk Shop on the Need for Safer Tech
Three of CISA’s top cyber experts reflect on what it means to be Secure by Design and Secure by Default and issue call to action to tech manufacturers.
What it Means to Be Secure by Design
Every technology provider must take ownership at the executive level to ensure their products are both secure by design and secure by default.
What is Secure by Design?
Secure by Design products are those where the security of the customers is a core business requirement, not just a technical feature. Secure by Design principles should be implemented during the design phase of a product’s development lifecycle to dramatically reduce the number of exploitable flaws before they are introduced to the market for broad use or consumption.
What is Secure by Default?
Secure by Default products are those that are secure to use out of the box, with little to no configuration changes and are available at no additional cost, such as multi-factor authentication (MFA), gather and log evidence of potential intrusions, and control access to sensitive information.
Watch CISA Director Easterly's Remarks at Carnegie Mellon University
Unsafe at Any CPU Speed: The Designed-in Dangers of Technology and What We Can Do About It
Related News and Resources
The Urgent Need for Memory Safety in Software Products
CISA and Microsoft Partnership Expands Access to Logging Capabilities Broadly
When Tech Vendors Make Important Logging Info Available for Free, Everyone Wins
Leading the Way with Radical Transparency
U.S. and International Partners Publish Secure-by-Design and -Default Principles and Approaches
Take the Pledge!
If you are a K-12 education technology vendor and would like to join the pledge, please email us at SecureByDesign@cisa.dhs.gov.
Contact Us
Please share your thoughts by emailing us at: SecureByDesign@cisa.dhs.gov.