Redefining 'Secure by Design': Navigating Shifts in Modern SecOps

A recent CISA report has sparked debate about long-standing assumptions in the cybersecurity industry, challenging core beliefs about secure-by-design principles and DevSecOps methodologies. Delivered on October 11, the report from a federal advisory subcommittee suggests a need to rethink how security is integrated into software development. It questions two key notions: that fixing vulnerabilities during production is 100 times more expensive than addressing them early in the development cycle and that poor security quality significantly impacts consumer trust.

Veteran cybersecurity expert Adrian Sanabria weighed in, suggesting the findings validate skepticism about the industry's over-reliance on secure-by-design ideals. “Cybersecurity isn’t the top priority for businesses—it’s far from it,” Sanabria remarked, emphasizing that while regulations like GDPR provide incentives, many organizations lack the urgency previously assumed.

Sanabria advocates for adaptive strategies that align with modern infrastructure. He suggests that emerging technologies like container orchestration can naturally enhance security by making systems impermanent and easily replaceable after an attack. Instead of relying on developers to master secure-by-design methods, businesses should focus on improving incident response, penetration testing, and visibility into live infrastructure.

The report also hints at a shift in executive responsibilities, with roles like Chief Information Security Officer (CISO) becoming less desirable due to personal liability and expanding job scopes. As companies adapt to evolving threats and technologies, new leadership roles such as Chief Risk Officer or Chief AI Officer may emerge, fundamentally reshaping the cybersecurity landscape.

Sanabria calls for a proactive approach: conducting frequent attack simulations, improving collaboration across teams, and embracing automation to reduce vulnerabilities. With these shifts, the industry can transition from reactive defenses to more resilient, forward-thinking strategies.

Source : Rethinking 'secure by design' amid slippery SecOps shifts | TechTarget