Security by Design in Perspective
Published by The Lawfare Institute
in Cooperation With
Editor’s Note: Google provides financial support to Lawfare. This article was handled independently pursuant to Lawfare’s standard editorial process.
In this paper for Lawfare’s Security by Design Paper (SbD) Series, Omid Ghaffari-Tabrizi, Justin Sherman, and Paul Rosenzweig reflect on the lessons learned from two years of research into software security by design. Building on more than two dozen articles, papers, and podcasts, they analyze how SbD can be more clearly defined, measured, standardized, and incentivized, while highlighting the challenges of developing metrics, the domestically focused nature of standards-setting, and the competing models for liability and compliance. The authors draw parallels to other regulatory frameworks, such as privacy by design, and emphasize that securing software requires a mix of law, policy, technology, and private-sector innovation. They conclude by identifying key open questions for future research, including international standards-setting, optimizing incentives, and understanding shifting public risk tolerance for insecure software.
Download the paper here or below.
