As part of its ongoing efforts to improve cybersecurity, the Biden-Harris Administration has announced that it has approved a secure software development attestation form.
The form, which was jointly developed by CISA and the Office of Management and Budget (OMB), will be required to be filled out by any company providing software that the Government will be using. It will help ensure that the software was developed by companies that prioritize security.
“The requirements in the form represent some fundamental secure development practices that suppliers looking to sell software to the Federal government should be in a position to meet if they want to play in the Federal regulated ecosystem,” said Chris Hughes, chief security advisor at Endor Labs and Cyber Innovation Fellow at CISA.
One of the requirements in the form is that the software be developed in a secure environment. This includes separating production and development environments, minimizing use of insecure products in the code, enforcing multi-factor authentication across the environments, encrypting sensitive data, implementing defensive practices like continuous monitoring and alerting, and routinely logging, monitoring, and auditing trust relationships.
“Practices such as separating development and production environments, implementing logging and MFA are critical security controls that should exist in any modern secure software development environment,” said Hughes.
Another requirement is to make a good-faith effort to maintain trusted supply chains by using automated tools for monitoring third-party code, and maintaining provenance for internal code and third-party components.
It also requires the regular use of automated tools that check for security vulnerabilities, including having a policy in place to disclose and address known vulnerabilities.
Hughes believes there are some elements missing from this form, however. For instance, it doesn’t require the use of threat modeling or memory safety, which has been something that CISA has been pushing for. He said it also allows the CEO to designate others to be able to sign off on the attestation as a potential scapegoat if things go wrong or the attestation was falsified.
“On one hand we hear that cybersecurity needs to be a boardroom issue and CISA even calls for C-suite involvement in their publications around secure-by-design/default, but then this form allows for this key attestation activity to be delegated to someone else in the organization and potentially keeping it from being as visible to the C-suite/CEO and executive leadership team,” said Hughes.
Hughes believes that the software producers who will have the hardest time meeting the attestation requirements are those that haven’t implemented secure software development practices already.
“They will need to assess their current development practices, identify deficiencies and implement plans to rectify them,” he said. “This of course takes time and resources, which smaller startups and immature organizations have finite access to, especially against competing demands for speed to market, revenue, return for investors, feature velocity and more.”
The form will be available for online submissions on CISA’s website starting later this month.
