CISA Secure by Design

1. Secure by Design Overview

   CISA program overview of building security into products.

2. Secure by Design Pledge

   Seven goals manufacturers commit to, such as MFA, default passwords and vulnerability disclosure.

3. Principles and Approaches

   Take ownership of outcomes, radical transparency and lead from the top.

4. Secure by Demand Guide

   Questions customers ask suppliers about product security.

5. Memory Safety Roadmaps

   Moving from memory-unsafe languages to memory-safe languages.

6. Alert Eliminating XSS

   Eliminating cross-site scripting vulnerability class by design.

7. Alert Eliminating OS Command Injection

   Eliminating OS command injection vulnerability class by design.

8. Alert Eliminating Directory Traversal

   Eliminating path traversal vulnerability class by design.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

• CIS Benchmarks
• CIS Critical Security Controls
• CycloneDX
• NIST SSDF (SP 800-218)
• OpenSSF Scorecard
• SLSA
• SPDX
• Threat Modeling (OWASP and STRIDE)
• Zero Trust (NIST SP 800-207)