All news with #secure by design tag

🔐 This article outlines how frontier AI is changing vulnerability management by producing vastly greater volumes of findings and shifting the CISO challenge from speed to scale and accuracy. It describes Microsoft’s use of AI-powered scanning, harness layers like MDASH, and Red Teaming to find and mitigate flaws, while urging defense-in-depth and Secure by Default controls such as Microsoft Baseline Security Mode (BSM). The post emphasizes coordinated open-source scanning, risk-based decision making, and rolling out secure defaults to reduce exploitation risk.

🛡️ CREST has awarded its new AI-Enabled Penetration Testing accreditation to 10 firms across Europe, India and the US as an optional module added to its Penetration Testing Accreditation Standard in July 2026. The module lets providers that integrate AI into pentesting undergo independent assessment to demonstrate responsible, secure AI governance to clients and regulators. CREST’s move follows its March 2026 report and subsequent AI Principles and June AI Charter.

🔒 Microsoft warns that AI-driven tools are accelerating vulnerability discovery and exploit generation, making traditional reactive patching and detection-centric defenses insufficient. David Weston of Microsoft highlighted MDASH findings showing rapid, low-cost exploit generation and urged industry shifts toward memory-safe languages like Rust, proactive secure-by-construction methods, and AI-assisted remediation. The talk, delivered at Black Hat USA, framed resilience and prevention as the new priorities.

🔒 2F-IT has built a Fortinet-centric consultancy in Germany by concentrating senior NSE 8 expertise within a compact team. This approach embeds expert practitioners into delivery, mentorship, and architecture decisions, reducing reliance on single points of failure. The firm supports certification through labs, mentoring, and incentives, translating deep technical capability into higher quality, resilient customer outcomes across complex environments.

🔒 This article presents a blueprint for securing AI workloads on Google Kubernetes Engine (GKE), consolidating controls across Google Cloud services and GKE features to create a secure-by-default platform. It covers three layers—infrastructure, supply chain, and application—and details capabilities such as Confidential GKE Nodes, Workload Identity Federation, k8s-aibom for AI SBOMs, Model Armor, and the GKE Inference Gateway. The blueprint recommends a three-phase rollout: Deploy, Operate, and Govern, and emphasizes integrating Google Cloud controls to maintain security at enterprise scale.

🔒 CISA and four international cybersecurity agencies have issued joint guidance urging software vendors and online service providers to establish coordinated vulnerability disclosure (CVD) programs. The guidance outlines how to publish clear disclosure policies, maintain communication with researchers, and handle reports for software, hardware, and network products. It supports CISA’s Secure by Design initiative and emphasizes prioritization, exploitability-based assessment, and validating compensating controls when patches are unavailable.

🔒 The NCSC asked pen testers what makes their work harder and published recommendations to boost organisational resilience. Responses emphasise secure-by-design practices—like threat modelling, phishing-resistant MFA, avoiding hard-coded credentials, and early input validation—alongside network segmentation and strong OT/IT separation. The guidance also highlights the critical role of quality logging, monitoring and exercised incident response to detect and respond to intrusions.

🔒 The Five Eyes cybersecurity agencies warn that rapidly advancing AI capabilities are already reshaping offensive and defensive cyber operations and urge CSOs to treat cyber risk as core business risk. They recommend prioritizing secure-by-design practices, defense in depth, rapid patching, reduced attack surface, stronger identity controls, and testing breach responses. Some experts call the guidance too general or overdue but agree it reinforces the need for executive alignment and urgent action.

🔒 GitHub has updated actions/checkout to v7 to automatically block and fail workflows that attempt to fetch unreviewed fork pull request code when run under pull_request_target or workflow_run events. The change enforces a secure-by-default behavior, with an explicit opt-out allow-unsafe-pr-checkout available for developers who need it. Backports to supported major versions are planned beginning July 16; pinned SHAs and specific versions must be updated manually.

🔍 ENISA chief Hans de Vries told ESET World that AI-powered vulnerability scanners mean firms can no longer claim ignorance of software bugs. He warned that the Cyber Resilience Act and emerging AI tools require security by design and that failure to use AI coherently risks exploitation and litigation. The NCSC also expects AI to expose poorly coded systems while vendors adopt AI to remove flaws.

🔒 Azure IaaS combines a layered defense-in-depth architecture with Microsoft’s Secure Future Initiative—secure by design, secure by default, and secure in operation—to protect compute, networking, storage, and operations. Hardware roots of trust, measured boot, and host isolation reduce platform exposure while VM protections such as Trusted Launch and confidential computing guard workloads at runtime. Network defaults enforce least privilege and private connectivity, and centralized telemetry in Azure Monitor and Defender for Cloud enables continuous detection and response.

🛡️ Google has integrated a Rust-based DNS parser into the modem firmware for Pixel 10, marking the first Pixel modem component written in a memory-safe language. The change aims to eliminate a broad class of memory-safety bugs in DNS handling, using the hickory-proto crate adapted for embedded use and a custom cargo-gnaw tool to manage dependencies. The Rust implementation exposes a C API and dispatches existing C functions to update in‑memory structures.

🔒 CrowdStrike explains how Falcon for IT helps enterprises manage the transition from the Windows UEFI CA 2011 certificate to Windows UEFI CA 2023 ahead of Microsoft’s 2026 enforcement. The content pack provides fleet-wide Secure Boot posture assessment, controlled enrollment into Microsoft’s managed rollout, emergency blocking for incompatible hardware, and centralized audit logging. It emphasizes validating virtualization stacks, coordinating endpoint and server teams, and completing staged rollouts before enforcement to avoid inconsistent firmware trust states and compressed remediation windows.

🔐Google announced a new advanced flow for Android sideloading that imposes a mandatory 24-hour wait and biometric or PIN confirmation before permitting installs from unverified developers. The measure complements a developer verification mandate and is intended to make social‑engineering and rapid coercion attacks harder. Google will also offer free limited distribution accounts for hobbyists and students and says the flow does not apply to ADB installs; the changes roll out in August 2026 ahead of verification rules.

🔒 CISOs should treat innovation as a control: enable safe experimentation while reducing exposure across AI, IoT and cloud. The article urges leaders to remove toil, standardize repeatable patterns, and provide golden paths so secure options are also the fastest. It recommends guardrails, mandatory exit criteria for pilots, and measurable outcomes to prevent innovation debt. The goal is to accelerate business velocity while demonstrably reducing risk.

🔐 Android 17 public beta introduces a secure-by-default architecture that tightens app protections and refines developer workflows. The release deprecates the android:usesCleartextTraffic attribute and will block cleartext by default for apps targeting API level 37 without a network security configuration. It also adds a public SPI for HPKE hybrid cryptography, enables certificate transparency by default and introduces install-time permissions for localhost interactions. Large-screen behavior changes, a lock-free MessageQueue and generational garbage collection in ART target performance, while Google replaces the traditional Developer Preview with a continuous Canary channel for earlier feature access and streamlined testing.

🛡️ Microsoft Deputy CISO for Government and Trust Tim Langan outlines a proactive approach to protecting government data, emphasizing collaboration across teams and partners. The post advocates defend forward threat hunting, the Cybersecurity Governance Council for cross-functional decision-making, and embedding security through initiatives like the Secure Future Initiative. Key focus areas include secure-by-design development, paved paths for compliance, and accelerating secure solutions for federal and defense scenarios.

🔐 Tom Curry and Anton Chuvakin from Google Cloud’s Office of the CISO present practical guidance for implementing the Secure AI Framework (SAIF) on Google Cloud. The piece emphasizes three operational principles: treat data as the perimeter, treat prompts like code, and require identity propagation for agentic AI. It maps 15 common AI risks to controls and highlights concrete tools and patterns—IAM, Dataplex, Vertex AI, Model Armor, Gemini, Apigee, and the Agent Development Kit—to operationalize SAIF.

🛡️ CISA announced the retirement of ten Emergency Directives issued between 2019 and 2024 after required mitigations were implemented or their coverage was incorporated into BOD 22‑01 and CISA’s Known Exploited Vulnerabilities catalog. The closures include directives tied to specific CVEs and high‑profile incidents such as SolarWinds and Exchange. CISA said the action reflects strengthened federal remediation, operational collaboration, and continued emphasis on Secure by Design principles.

🔒 The post argues that financial institutions must treat cybersecurity as the foundation for safe AI adoption, centering on three imperatives: understand the AI–cybersecurity nexus, harness AI to accelerate detection and response, and adopt Secure AI by Design. It highlights AI-driven SOCs that distill billions of events into actionable incidents and cites customer outcomes such as dramatic reductions in MTTR and large-scale threat prevention. The author also describes new AI-specific risks to data, models and agents, and calls for enterprise governance, risk-tiered inventories, strict access controls and coordinated policy to enable innovation while managing systemic risk.