CISA urges software vendors to adopt secure by design practices

The Cybersecurity and Infrastructure Security Agency (CISA) is reiterating its call for software vendors to adopt Secure by Design (SBD) development practices, highlighting that many exploited vulnerabilities are decades old, based on information published by The Register.

CISA's review of vulnerabilities from 2024 and 2025 reveals that the most frequently exploited flaws, often found in the Known Exploited Vulnerability (KEV) catalog, are rooted in long-standing weaknesses. These include injection-related vulnerabilities like cross-site scripting (XSS), OS command injections, and SQL injections, as well as issues stemming from improper input validation. These vulnerabilities, some identified as "unforgivable" as early as 2007, persist due to organizational culture and development workflows rather than technical complexity. CISA emphasizes that addressing these fundamental flaws would significantly reduce common compromises.

The agency recommends that vendors take ownership of security outcomes, eliminate these persistent weaknesses, and improve automation for configurations, monitoring, and updates. Software buyers are advised to prioritize vendors who demonstrate these practices and maintain software bills of materials (SBOMs) to manage supply chain risk.

Source: The Register