The U.S. CISA (Cybersecurity Infrastructure Security Agency) announced on Wednesday that it is spearheading a cross-agency initiative, alongside DARPA (Defense Advanced Research Projects Agency), OUSD R&E (Office of the Under Secretary of Defense for Research and Engineering), NSA (National Security Agency), and NNSA (National Nuclear Security Agency), to close what it calls the ‘software understanding gap,’ aiming to help both developers and users better analyze and validate software functionality, safety, and security before deployment. The effort builds on a joint report released earlier this year and a new analysis from Sandia National Laboratories that outlines the gap’s risks and strategic importance.
The lead cybersecurity agency identifies the need for tougher, scalable, cost-effective scrutiny of software is critical to protecting national infrastructure, and is calling on experts across sectors to get involved.
“As the Nation’s cyber defense agency, CISA jointly leads an interagency effort to tackle the national gap in software understanding,” Chris Butera, acting executive assistant director for cybersecurity, and Christine Lai, cybersecurity research and development lead, wrote in a CISA blog post. “We are driving efforts that enhance the ability to construct and analyze software to understand its functionality, safety, and security before organizations place it into use, both as producers and consumers of software.”
They added “Given our mission to understand, manage, and reduce risk to cyber and critical infrastructure, CISA is advocating for capabilities to thoroughly examine and scrutinize software under normal, abnormal, and hostile conditions. These capabilities must scale to the scope of the mission while delivering cost-efficient, reliable, and actionable answers.”
Earlier this year, CISA, along with DARPA, OUSD R&E, and the NSA, published a joint report, Closing the Software Understanding Gap. The report provides recommendations to take deliberate and coordinated measures to close this gap before our adversaries can exploit it.
Manufacturers and developers should design software for analysis—that is, design it to support independent efforts to scrutinize its artifacts rather than just source code. This scrutiny helps make software more secure by enabling verification and validation of its possible behavior before organizations and individuals place it into use.
To start addressing this need, Sandia National Laboratories recently published a report, The National Need for Software Understanding. This report describes the software understanding gap, the risk it poses to national security and critical infrastructure missions, historical decisions that led to the gap, and options to address it.
Butera and Lai identified that the software understanding gap is a difficult challenge to address, but one that is vital to solve. “Closing the gap will likely require robust public-private collaboration to create the necessary capabilities.”
They added that by providing an adequate capacity for software understanding, the U.S. will harden critical infrastructure against state-sponsored activity and secure an advantage in geopolitics for the foreseeable future. “We invite software analysis experts and mission owners to engage with CISA and our partners at DARPA, OUSD R&E, NSA, and National Nuclear Security Agency as we collectively shape research priorities and maintain a sustained focus on addressing this critical challenge.”
Last August, the CISA published a guide that consolidates relevant software assurance guidance and frameworks into a single document and enables stakeholders to navigate through these requirements in a clear, concise manner.
The Software Acquisition Guide focuses on the ‘Secure by Demand’ elements by providing recommendations for agency personnel, including mission owners and contracting staff or requirements office, to engage in more relevant discussions with risk owners and candidate suppliers that can be associated with the acquisition and procurement of software and cyber-physical products.
