Trustwave Rapid Response: CrowdStrike Falcon Outage Update. Learn More

Trustwave Rapid Response: CrowdStrike Falcon Outage Update. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Trustwave Takes CISA's Secure by Design Pledge

Trustwave is proud to announce that it has signed the Cybersecurity and Infrastructure Security Agency (CISA) Secure by Design Pledge, joining more than 150 other leading enterprise software manufacturers in committing to building stronger security features directly into our products.

"Trustwave has always believed that software creators must bake in security from beginning to end," said Trustwave CISO Kory Daniels. "This is the only way to create an industry where vendors can be confident that the software they are using is as secure as possible, ultimately reducing supply chain risk. As the world has become more digital, the number of vulnerabilities identified has also grown continuously. Third-party products and services are essential for many supply chains, and they have a responsibility to adopt a secure by design culture to prevent further expanding an organization's attack surface."

This pledge is a significant milestone for CISA's Secure by Design initiative, which aims to shift the responsibility for cybersecurity from individual users to the manufacturers who create the software we rely on. These manufacturers can help make our critical infrastructure more secure by focusing on building security from the ground up.

"More secure software is our best hope to protect against the seemingly never-ending scourge of cyberattacks facing our nation," said CISA Director Jen Easterly. "I applaud the companies who have already signed our pledge for their leadership and call on all software manufacturers to take the pledge and join us in creating a world where technology is safe and secure right out of the box."

 

What Does the Pledge Entail?

By participating in the pledge, software manufacturers agree to make a good-faith effort to work towards specific security goals over the following year. In the case where a software manufacturer can make measurable progress towards a goal, the manufacturer should publicly document how they have achieved such progress within one year of signing the pledge. If the software manufacturer is unable to make measurable progress, the manufacturer is encouraged to, within one year of signing the pledge, share with CISA how the manufacturer has worked towards the goal and any challenges faced. In the spirit of radical transparency, the manufacturer is encouraged to publicly document its approach so that others can learn. This pledge is voluntary and not legally binding.

Software manufacturers who sign the pledge agree to work towards seven key goals over the next year. These goals target some of the most common cybersecurity vulnerabilities, and achieving them will significantly impact the overall security landscape.

The Seven Goals are:

  • Increased Use of Multi-Factor Authentication (MFA ): MFA adds an extra layer of security beyond just a password, making it much harder for attackers to gain access to accounts.
  • Eliminating Default Passwords: Default passwords are easy to guess and crack, so eliminating them is crucial for better security.
  • Reducing Specific Vulnerabilities: Manufacturers will focus on identifying and eliminating entire classes of vulnerabilities in their software.
  • Encouraging Security Patch Installation: Keeping software up to date with the latest security patches is essential, and the pledge aims to make this process easier for users.
  • Publishing Vulnerability Disclosure Policies: These policies will allow security researchers to safely test software for vulnerabilities and report them to the manufacturer.
  • Transparent Vulnerability Reporting: Manufacturers will provide more detailed information about vulnerabilities and issue security patches in a timely manner.
  • Improved Detection of Intrusions: The pledge encourages manufacturers to develop tools that help users identify if their systems have been compromised.

"A more secure by design future is indeed possible. The items in the pledge directly address some of the most pervasive cybersecurity threats we at CISA see today, and by taking the pledge, software manufacturers are helping raise our national cybersecurity baseline," CISA Senior Technical Advisor Jack Cable said. "Every software manufacturer should recognize that they have a responsibility to protect their customers, contributing to our national and economic security. I appreciate the leadership of those who signed on and hope that every technology manufacturer will follow suit."

 

Pen Testing 6.27

Trustwave Penetration Testing can test all types of infrastructure, applications, systems, and endpoints specific to your industry and vertical.

Latest Trustwave Blogs

De-Risk Technology Transitions and Save Money with Trustwave

With all the issues happening in cybersecurity technology lately, such as CrowdStrike’s software update that caused massive outages worldwide last week, it behooves all organizations to take a...

Read More

How Cybercriminals Use Breaking News for Phishing Attacks

Trustwave SpiderLabs issued a warning that threat actors may attempt to take advantage of CrowdStrike’s software update that caused widespread outages by using the news as the center of a social...

Read More

Trustwave Response: CrowdStrike Falcon Outage Update

Trustwave is proactively assessing and monitoring our clients who may have been impacted by CrowdStrike’s recently rolled-out update for its Windows users. The critical issue identified with...

Read More