U.S. Department of Homeland Security/Cybersecurity and Infrastructure Security Agency (CISA) Repeating or Parroting Microsoft Talking Points
FOUR days ago we politely complained that some media echoed talking points about "Log4Shell" being a major threat. It was patched more than 2 years ago, so why does this FUD make a comeback all of a sudden?
CISA, where Microsoft writes policies, is at it again. We want to alert readers, at the very least by citing the material in question. We want to demonstrate our point by at least bringing up one media report and the original from CISA. Yes, there are more examples, but 2 ought to suffice.
"log4j" - connected to the above - is still being brought up this year by the Linux Foundation (by media sites that it is funding! Linux Foundation head honchos worship Bill Gates for computer security) and it is still getting milked by the Microsofters, an associate reminds us, and it is now softening the heads of government officials. see the 2 CISA items below (from Daily Links):
-
CISA urges vendors to get rid of default passwords
The call to action comes shortly after CISA, the National Security Agency and Office of the Director of National Intelligence released additional secure-by-design guidance for open source software development. The release is a product of the Enduring Security Framework’s Software Supply Chain Working Group, which is made up of NSA, ODNI and CISA. The guidance is a part of a larger effort to secure the software supply chain that stems from an executive order on improving U.S. cybersecurity.
“Software incorporated and/or utilized through open source may have embedded issues. It is imperative that we pay close attention to how these modules are bundled with the software at release,” the release said.
-
Securing the Software Supply Chain: Recommended Practices for Managing Open-Source Software and Software Bill of Materials [PDF]
Similarly, the ESF Software Supply Chain Working Panel established this second phase of guidance to provide further details for several of the Phase I Recommended Practices Guide activities. This guidance may be used to describe, assess, and measure security practices relative to the software lifecycle. Additionally, the suggested practices listed herein may be applied across a software supply chain’s acquisition, deployment, and operational phases. The software supplier is responsible for liaising between the customer and software developer. Accordingly, vendor responsibilities include ensuring the integrity and security of software via contractual agreements, software releases and updates, notifications, and the mitigation of vulnerabilities. This guidance contains recommended best practices and standards to aid customers in these tasks.
This document aligns with industry best practices and principles that software developers and software suppliers can reference. These principles include managing open-source software and software bills of materials to maintain and provide awareness about software security.
Also note their use of the term "open-source" instead of the normal "open source". The hallmark of openwashing PR.
We kindly and humbly wish not to speculate or comment any further. We just present that for what it is. █