Episode 205: Secure by Design — Now Updated for AI

In episode 205 of Cybersecurity Where You Are, Tony Sager speaks with Phyllis Lee, VP of SBP Content Development at the Center for Internet Security®(CIS®), and Steve Lipner, Executive Director of SAFECode. Together, they discuss how an updated document from CIS and SAFECode gives concrete guidance on what artificial intelligence (AI) means for your Secure by Design process.

Here are some highlights from our episode:

• 02:17. A refresher on making Secure by Design digestible for end organizations
• 02:57. Distillation and prescriptive guidance: The value provided by CIS
• 06:53. An overview of Butler Lampson's "Gold Standard of Security"
• 07:03. How a shift in approach to Secure by Design led to the founding of SAFECode
• 09:42. The importance of verification requirements for what developers have done
• 12:54. A product of CIS pragmatism: Prioritization relative to the development environment
• 20:06. Artifacts as evidence of secure software development at work
• 30:15. How the updated document provides guidance around AI
• 30:45. What AI creates instead of new classes of vulnerabilities

Resources

• CIS Critical Security Controls® (CIS Controls®)
• Secure by Design
• Secure by Design v1.1 A Guide to Assessing Software Security Practices
• Turning Secure Software Development into a Measurable Practice
• CIS and SAFECode Release Secure by Design v1.1: A Guide to Assessing Software Security Practices
• Episode 164: Secure by Design in Software Development
• CIS Critical Security Control 16: Application Software Security
• Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1
• Episode 200: Alan Paller's Vision and Our Next Chapter
• From Prompts to Protocols: The Security Blueprint for Enterprise AI
• Mythos AI: What Actually Matters for Cybersecurity Leaders

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.