Secure Software Development Gets a Push from CISA

In the wake of the CrowdStrike incident, the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Australian Signals Directorate (ASD) have issued new guidance aimed at fostering secure software deployment practices earlier in the software development lifecycle (SDLC). The recommendations emphasize the critical need to integrate security into every phase of the SDLC, ensuring robust testing and minimizing risks from flawed deployments.

In speaking with reporter John P. Mello Jr., technology leaders and industry experts have welcomed the framework. Experts from organizations including Gomboc.ai and Keeper Security say the recommendations are both “solid” and “relevant” for fostering safe and secure software deployments.

John Terrill, CISO at Phosphorus Cybersecurity, highlighted how the new recommendations dovetail with CISA’s earlier Secure by Design initiative, introduced in April.

“Secure by Design is not just an application security idea,” Terrill explained. “You want secure components, you want best practices around scanning code, testing, production—everything. But you also want to ensure it’s all deployed in a reasonable, controlled manner.”

Despite the initiative’s value, Terrill and others in the industry acknowledge that much of the advice is not new. “All of this is super common,” Terrill said, noting that the guidance serves as a reminder to prioritize fundamental practices.

He added, “I think this is a little bit of CYA. They’re just making sure they’ve got the information out there so nobody can say they didn’t state it.”

Read more at ReversingLabs and Security Boulevard for perspectives on this framework and the lessons learned from the CrowdStrike incident.

Read more from Phosphorus experts on recent cybersecurity news and trends in the following articles.

CISA’s Threat Sharing in a Death Spiral

Why CISA’s Plea to Network Defenders is a Forewarning for the Poor State of Security on ICS, OT, and IoT Cyber-Physical Systems

Finding Your ‘Creative Maliciousness’: John Terrill guests on Security Breach