PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Secure by Design: From pledge to practice

bugcrowd.com | blog | #cloud | #cisa | #cve | #vdp | #policy | #secure-by-design | #mfa | #software-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Six months into CISA's Secure by Design pledge, Casey Ellis reviews uptake among 250+ signatories like AWS and Google, its seven security goals, and what the industry must do to sustain momentum.
Published
Collected

Related coverage

blog · wiz.io
How Wiz Meets CISA “Secure by Design” Objectives
Wiz, a founding participant in CISA's Secure by Design initiative, details its pledge progress—no-cost SAML 2.0 SSO, mandatory MFA for direct logins, no default passwords, and least-privilege service accounts.
blog · bugcrowd.com
CISA’s VDP platform: Five years of collaborative defense
CISA’s VDP Platform marks five years with nearly 45,000 submissions and 5,300+ vulnerabilities fixed across 60+ federal agencies. See the key findings.
blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · semperis.com
NSA Top Ten Cybersecurity Misconfigurations: An Active Directory Perspective (Part 2)
Part 2 of the CISA/NSA top ten misconfigurations series for hybrid AD: flat networks, poor patch management, bypassed access controls, and weak MFA—explained with identity risks, IOEs, and IOCs.
vulnerability · yeswehack.com
US House passes bill mandating vulnerability disclosure policies for federal contractors
The US House passed a bill mandating VDPs for federal contractors, consistent with NIST guidelines; the roundup also covers the UK Home Office's own vulnerability disclosure policy launch.
blog · bugcrowd.com
A foundation of quicksand: How AI slop is impacting public sector security
The real public sector security crisis isn't AI slop but decades of technical debt and weak foundations that AI exposes; human researchers remain a critical force multiplier.
Back