Secure by Design, Secure by Default  🔗 **Source:** [Secure by Design, Secure by Default](https://www.cisa.gov/securebydesign) > [!note]+ Document Notes > 1. How has the cybersecurity burden shifted from technology manufacturers to consumers and small organizations? > 2. Why is it important for technology manufacturers to claim ownership of their customers' security outcomes? > 3. What is the difference between Secure by Design and Secure by Default? > 4. Why should Secure by Design principles be implemented during the design phase of a product's development lifecycle? > 5. What steps can technology providers take to shift the burden of cybersecurity to themselves instead of consumers? 📄 **Full text:** ![[Full Document Contents/Articles/Secure by Design, Secure by Default|Secure by Design, Secure by Default, Cybersecurity and Infrastructure Security Agency CISA]] ## Highlights - Government cannot solve this problem alone. Technology manufacturers must increasingly embrace their role in putting consumer safety first. Technology providers and software developers must take the first step to shift this burden by claiming ownership of their customers’ security outcomes. ([View Highlight](https://read.readwise.io/read/01j6jrzfexsv62x0bdjnc4rqpb)) - Note: In this week’s digest, we explore the enlightening insights from the Cybersecurity and Infrastructure Security Agency’s article, "Secure by Design, Secure by Default." It emphasizes the vital role that technology manufacturers and software developers play in prioritizing consumer safety by integrating security into the core of their business practices. With a call for standardized "secure by default" settings, this article encourages us to rethink our approach to cybersecurity, reminding us that a secure product is not just a feature—it's a fundamental expectation. **Background:** I am a Developer Advocate at GoDaddy, specializing in open source and WordPress. I am seeking to articulate how the insights from the article "Secure by Design, Secure by Default" by the Cybersecurity and Infrastructure Security Agency (CISA) align with my professional focus and career objectives. --- ### Key Takeaways 🔒 **Emphasize Ownership of Security:** Technology manufacturers, including software developers, must take responsibility for their customers' security outcomes. This shift requires a cultural change where security is integrated into the core business practices rather than being an afterthought. ⚙️ **Implement Secure Design Practices:** It is crucial to implement specific practices and principles during the product development phase to ensure that products are secure by design. Focusing on security from the outset can significantly reduce vulnerabilities and enhance user trust. 🌐 **Standardize "Secure by Default":** Developing standardized practices for "secure by default" settings across various technology products can improve consumer trust and safety. This involves creating user-friendly defaults that prioritize security without compromising usability. 1. How can technology manufacturers effectively shift the responsibility for cybersecurity from consumers to themselves, ensuring that security is a core business requirement? 2. What specific practices and principles should be implemented during the design phase of product development to ensure that products are secure by design? 3. In what ways can the concept of "secure by default" be standardized across different technology products to enhance consumer trust and safety?