Today, I’ll be testifying to the House Homeland Security Committee during a hearing at Stanford. Tune in here: homeland.house.gov/hearing/comm...

New from Jen Easterly and me: as threats to our critical infrastructure increase, U.S. policymakers need to defend + strengthen the role of security research. This is personal for me, having received legal threats for good-faith security research. www.lawfaremedia.org/article/adva...

📢 Excited to share that I started a new company, Corridor, with Ashwin Ramaswami! Corridor is the AI-powered secure by design platform – and we're backed by @stamos.org, Chris Krebs, Christina Cacioppo, @alip.bsky.social at Neo, and Sarah Guo at Conviction. forms.gle/3LsFxtNqzok2...

After two incredible years, today is my last day at CISA. Immensely grateful to have been able to drive CISA's work on Secure by Design, spurring commitments from 250 software manufacturers and publishing guidance with over a dozen int'l partners. My exit interview: cyberscoop.com/jack-cable-c...

🔒 New from CISA, some tips on protecting your communications in light of compromises of telecom infrastructure. Includes: 1. Use only end-to-end encrypted messaging apps such as Signal. 2. Enable FIDO auth (security keys or passkeys) wherever possible. 3. Do not use a personal VPN.

📣 CISA is hosting an info session on the Secure by Design Pledge on Monday, Dec 9 from 10-12pm in San Francisco. Come to hear from Bob Lord, me, and a panel with pledge signers around progress and lessons learned from the pledge. Register here: forms.office.com/g/Ta5g0P6Q5m

ICYMI: CISA published the Product Security Bad Practices for public comment, due Dec 16. Included in the bad practices: development of new products in memory unsafe language, inclusion of user input in SQL queries/OS commands, default passwords, and more. www.cisa.gov/resources-to...

My keynote from All Things Open is now online, covering Secure by Design, open source AI, and our Product Security Bad Practices guidance: www.youtube.com/watch?v=Furf...

It's the six-month anniversary of CISA's secure-by-design pledge. I talked to @jackhcable.bsky.social about how things are going and what's next: therecord.media/cisa-jack-ca... New details in here about participant workshops, CISA's plans for tracking progress, and version 2.0 of the pledge.

Today, I published in the Harvard Business Review on how business leaders of software manufacturers can prevent ransomware attacks at scale with more secure by design software. Read here: hbr.org/2024/04/prev...

Great joining @rosenzweigp.bsky.social on the Lawfare Podcast! Tune in for some holiday listening to hear from Lauren Zabierek, Bob Lord and me on CISA's path forward on Secure by Design. www.lawfaremedia.org/article/the-...

Have thoughts on Secure by Design? Yesterday, CISA announced a Request for Information on Secure by Design. Have thoughts on eliminating classes of vulns, security education for developers, economics, AI, OT, and more? Check it out and respond (by Feb 20): www.federalregister.gov/documents/20...