Amid heightening global digital security concerns, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the FBI, has recently released the Secure by Design initiative. This initiative outlines critical security practices for software manufacturers, particularly those serving critical infrastructure or National Critical Functions (NCFs). These recommendations are intended to guide software developers toward reducing risk by embedding security into the very core of their development process. 

While CISA’s guidance focuses on addressing bad practices across product properties, security features, and organizational policies, Vaultree’s unique approach to Data-In-Use Encryption supports the secure by design effort by providing  a powerful, preemptive solution. Vaultree enables organizations to carry out encrypted operations at an enterprise scale, ensuring that data is secure during its entire lifecycle—an innovation that directly aligns with CISA’s recommendations and goes beyond traditional security measures.

This article will explore the key points outlined in CISA’s Secure by Design initiative, the associated risks, and how Vaultree’s cutting-edge technology preemptively addresses many of these vulnerabilities, offering a next-generation solution for data security.

‍

Overview of CISA’s Secure by Design Initiative

‍

The Secure by Design guidance by CISA and the FBI provides an actionable framework for software manufacturers to ensure that security is at the forefront of software development, particularly when it comes to products used for critical infrastructure. The document focuses on three key areas:

1. Product Properties: These describe the observable, security-related qualities of a software product, such as the language it’s built-in and how it handles vulnerabilities like SQL injection.
2. Security Features: These refer to the functionalities that enhance the security of a product, including multi-factor authentication (MFA) and logging for intrusion detection.
3. Organizational Processes and Policies: These involve the actions and transparency demonstrated by a company regarding its security measures, such as publishing vulnerability disclosure policies and addressing known vulnerabilities swiftly.

CISA further highlights several bad practices that pose an especially high risk for manufacturers serving critical infrastructure, and the agency provides recommendations for mitigating these issues. This initiative is a call to action for software manufacturers to avoid these pitfalls and take responsibility for their customers' security outcomes by embedding security into every stage of their product development lifecycle. Vaultree collaborates with OpenPolicy which has partnered and provided comments to CISA on the development of the Secure by Design policy effort, and will engage with CISA on the upcoming “bad practices” release. 

‍

Key Bad Practices Identified in the Secure by Design Initiative 

‍

1. Developing in Memory-Unsafe Languages

Developing software using memory-unsafe languages, like C or C++, without a clear roadmap to address memory safety vulnerabilities is highlighted as an exceptionally risky practice. Software manufacturers working with critical infrastructure are urged to use memory-safe languages or implement rigorous safeguards against memory vulnerabilities.

2. SQL Injection and Command Injection Vulnerabilities

Allowing user input to be included directly in SQL or operating system command strings significantly elevates security risks, particularly for critical infrastructure. CISA recommends that products be built to systematically prevent SQL injection and command injection by using best practices like parameterised queries.

3. Default Passwords and Known Exploited Vulnerabilities (KEVs)

The use of default passwords and the inclusion of open-source software with known vulnerabilities are deemed dangerous. CISA advises manufacturers to ensure that passwords are instance-unique and to patch any known vulnerabilities promptly, particularly those listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

4. Lack of Multi-Factor Authentication (MFA)

CISA highlights the absence of MFA as a major security flaw. After January 1, 2026, products used for critical infrastructure must have MFA enabled by default for administrator accounts to mitigate unauthorized access risks.

5. Failure to Publish Vulnerability Disclosure Policies

Failure to publish clear and transparent vulnerability disclosure policies (VDPs) is seen as a failure of responsibility. CISA calls on manufacturers to allow public vulnerability testing and to follow coordinated vulnerability disclosure practices.

‍

How Vaultree Addresses Secure by Design Challenges with Data-In-Use Encryption 

‍

While CISA’s Secure by Design initiative offers critical guidance to address these bad practices, Vaultree’s groundbreaking solutions go further by preemptively solving many of these issues with the Data-In-Use Encryption mindset. This innovation, particularly suited for enterprise-scale operations, addresses deeper structural issues that can lead to vulnerabilities. Here’s how Vaultree's technology aligns with CISA's goals to foster secure by design:

1. Memory Safety in Software Development

• Our Approach: Vaultree's technology operates on encrypted data using algorithms designed to be memory-safe. Since data remains encrypted even during processing, traditional memory manipulation attacks become ineffective. The encrypted data doesn't expose meaningful information, so even if a buffer overflow were possible, it wouldn't compromise sensitive data.
• Result: Memory safety vulnerabilities attack vector is reduced, as encrypted data cannot be exploited through traditional memory attacks.

2. Protection Against Code Injection Attacks

• Our Approach: With Vaultree, data remains encrypted during processing, and computations are performed on encrypted data without decryption. This means that even if an attacker injects malicious code, it interacts with encrypted data that they cannot interpret or manipulate meaningfully.
• Result: SQL and command injection attacks become futile, as the encrypted data does not respond to injected code in a way that benefits the attacker.

3. Elimination of Default Passwords

• Our Approach: Vaultree eliminates the reliance on passwords for data security. Instead, it uses robust cryptographic key management where keys are unique and managed securely. There are no default passwords to exploit because access is controlled through secure key distribution and management.
• Result: The risk associated with default passwords is reduced, as Vaultree's system doesn't rely on traditional password authentication for data protection.

4. Proactive Management of Vulnerable Components

• Our Approach: Even if certain components have vulnerabilities, Vaultree's end-to-end encryption ensures that data remains secure. Since data is always encrypted, vulnerabilities in components that process the data don't lead to data breaches.
• Result: The threat posed by vulnerable components is significantly mitigated, as encrypted data remains protected despite underlying software flaws.

5. Mandatory Multifactor Authentication

• Our Approach: While Vaultree supports and encourages MFA for additional security, the constant encryption of data reduces the reliance on authentication mechanisms to protect data integrity. Unauthorized access to systems doesn't equate to access to unencrypted data.
• Result: Even if authentication mechanisms are compromised, encrypted data remains secure, reducing the risk and  impact of MFA vulnerabilities.

‍

Conclusion

‍

Vaultree's approach to data security fundamentally changes the threat landscape:

• Data Remains Secure Even If Systems Are Compromised: Since data is always encrypted, unauthorized access to systems doesn't result in data breaches.
• Traditional Attack Vectors Are Neutralised: Common exploits like buffer overflows, SQL injections, and default password attacks become ineffective against encrypted data.
• Reduced Reliance on Perimeter Defenses: With data encrypted in use, the need for traditional security measures, while still beneficial, becomes less critical for data protection.

‍