CISA Unveils ‘Exceptionally Risky’ Software Bad Practices

The U.S. cyber defense agency is warning software providers against developing new product lines using memory-unsafe languages and other “exceptionally risky practices” that threaten critical infrastructure sectors and national security.

See Also: The State of OT Security: A Comprehensive Guide to Trends, Risks, and Cyber Resilience

The Cybersecurity and Infrastructure Security Agency and FBI released a joint guide Wednesday on product security bad practices, seeking public comment on a catalog of insecure development techniques, such as directly including user-provided input in SQL database queries or operating system command strings. The catalog lists the most dangerous products in three categories: product properties, security features and organizational processes and policies.

“It’s 2024, and basic, preventable software defects continue to enable crippling attacks against hospitals, schools, and other critical infrastructure,” CISA Director Jen Easterly said in a statement accompanying the guidance, adding: “This has to stop.”

Among the bad practices: releasing software with default passwords, which the federal agencies say should instead ship with random, instance-unique initial passwords for products used in service of critical infrastructure. The recommendations align with the digital identity guidelines from the National Institute of Standards and Technology, which call for an overhaul of digital password practices (see: NIST Calls for Major Overhaul in Typical Password Practices).

Experts told Information Security Media Group the guidance builds on CISA’s push to hold software providers accountable for implementing minimum security development standards. Leading software companies and technology giants alike have recently joined CISA’s initiative to embed stronger security measures directly into product design, shifting the burden of security from end users to developers as part of a broader effort to enhance product safety from the ground up (see: Technology Giants Join CISA’s Secure by Design Pledge).

“These bad practices represent the bare minimum that all software producers should be able to comply with,” said Chris Wysopal, co-founder of the application security firm Veracode. “For companies creating software that supports critical infrastructure or national critical functions, cutting corners and ignoring these guidelines is nothing short of reckless.”

The guidance includes fundamental cybersecurity measures such as implementing multifactor authentication and avoiding the inclusion of components in new products that contain exploitable vulnerabilities listed in CISA’s known exploited vulnerabilities catalog. CISA and the FBI also warn that failing to publish timely notices of newly-discovered vulnerabilities in products that service critical infrastructure sectors “significantly elevates risk to national security.”

Many software providers are still failing to implement some of the most basic cybersecurity measures into their new product offerings, according to Neil Carpenter, field chief technology officer for Orca Security.

“The sad truth is [CISA’s] latest advisory encapsulates the litany of poor product design decisions made over the years that result in countless organizations being compromised,” Carpenter told ISMG. “These are actions that every engineering and product leader should be taking and every organization buying software should hold their providers accountable for.”

CISA released a secure-by-design roadmap in 2023 that recommended manufacturers begin by performing risk evaluations to identify the top cyber threats impacting critical systems, then building protections into their product blueprints (see: CISA, Others Unveil Guide for Secure Software Manufacturing). The guidance recommended manufacturers prioritize the use of memory safe programming languages and “make hard tradeoffs” when necessary to protect customers over adopting unsafe features.

The public and key stakeholders have until Dec. 2 to submit feedback on the catalog via the Federal Register.