[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572980-105":53,"doc-detail-572980-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","product-security-bad-practices-version-2-january-2025","Product Security Bad Practices - Version 2 - January 2025","","Product Security Bad Practices (Version 2, January 2025) provides voluntary product security guidance from CISA and the FBI to software manufacturers developing on-premises software, cloud services, SaaS, and products running on operational technology or embedded systems. It explains exceptionally risky security practices to avoid across three areas: product properties, supported security features, and organizational processes and policies. The document summarizes the rationale and offers recommendations to reduce customer risk, while remaining non-binding with distribution permitted under TLP:CLEAR.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/product-security-bad-practices-version-2-january-2025/572980/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/product-security-bad-practices-version-2-january-2025/572980.png","ImageObject",442,249,{"name":88,"@type":89},"AfterMidnight","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":9},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"Who issued this Product Security Bad Practices guidance and who is it for?","Question",{"text":108,"@type":109},"The guidance was developed by CISA and the Federal Bureau of Investigation (FBI). It is intended for software manufacturers that develop software products and services, including on-premises software, cloud services, SaaS, and software used on operational technology or embedded systems.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What are the three categories of bad practices described in the document?",{"text":113,"@type":109},"The bad practices are divided into three categories: Product properties, Security features, and Organizational processes and policies.",{"name":115,"@type":106,"acceptedAnswer":116},"Is this guidance legally binding on manufacturers?",{"text":117,"@type":109},"No. The guidance is non-binding; it encourages avoiding the listed bad practices but imposes no requirement to do so.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},572980,1792460359,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":9,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":76},962090896061,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","Product Security Bad Practices  \nVersion 2  \nPublication: January 2025  \nCybersecurity and Infrastructure Security Agency  \nFederal Bureau of Investigation  \nThis document is distributed as TLP:CLEAR. Disclosure is not limited. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be distributed without restriction. For more information on the Traffic Light Protocol, [see cisa.gov/tlp](see cisa.gov/tlp).  \nTLP:CLEAR  \nChange Record  \n\n| Version | Date | Revision/Change Description | Section/Page Affected |\n| --- | --- | --- | --- |\n| 1.0 | October 2024 | Initial Version |  |\n| 2.0 | January 2025 | Feedback incorporated from the 78 public comments CISA received in response to our Request for Information. This includes:\u003Cbr>􀂃 Three new bad practices on use of known insecure or outdated cryptographic functions, hardcoded credentials, and product support periods.\u003Cbr>􀂃 Additional context added to the memory safety section.\u003Cbr>􀂃 Added additional examples of recommended actions to prevent SQL injection vulnerabilities.\u003Cbr>􀂃 Added additional examples of recommended actions to prevent command injection vulnerabilities.\u003Cbr>􀂃 Clarified timelines for patching Known Exploited Vulnerabilities (KEVs) .\u003Cbr>􀂃 Added language for multi-factor authentication (MFA) specific to operational technology products.\u003Cbr>􀂃 Added that software manufacturers should support phishing-resistant MFA.\u003Cbr>􀂃 Other updates to phrasing throughout. | Updates throughout. |\n\nOverview  \nAs outlined in the Cybersecurity and Infrastructure Security Agency’s (CISA’s) Secure by Design initiative, software manufacturers should ensure that security is a core consideration from the onset of software development and throughout the entirety of the development lifecycle. This voluntary guidance provides an overview of product security bad practices that are considered exceptionally risky, particularly for software manufacturers who produce software used in service of critical infrastructure or national critical functions (NCFs) . This guidance also provides recommendations for software manufacturers to mitigate these risks.  \nCISA and the Federal Bureau of Investigation (FBI)—hereafter referred to as the authoring organizations—developed this guidance to urge software manufacturers to reduce customer risk by prioritizing security throughout the product lifecycle. This document is intended for software manufacturers who develop software products and services, including on-premises software, cloud services, and software as a service (SaaS) . This also applies to software products that run on operational technology (OT) products or embedded systems. The authoring organizations strongly encourage all software manufacturers to avoid these product security bad practices. By following the recommendations in this guidance, manufacturers will signal to customers that they are taking ownership of customer security outcomes, a key secure by design principle. The guidance contained in this document is non-binding, and while the authoring organizations encourage avoiding these bad practices, this document imposes no requirement to do so.  \nThe bad practices are divided into three categories.  \n1. Product properties, which describe the observable, security-related qualities of a software product.  \n2. Security features, which describe the security functionalities that a product supports.  \n3. Organizational processes and policies, which describe the actions taken by a software manufacturer to ensure strong transparency in its approach to security.  \nThis list is focused and does not include every possible inadvisable cybersecurity practice. The lack of inclusion of any particular cybersecurity practice does not indicate that the authoring organizations endorse or deem such a practice to present acceptable levels of risk. Item","cbCaivbYZewr30ae","https://ap.wps.com/l/cbCaivbYZewr30ae","pdf",786734,9,"English","# Overview\n## Purpose and scope\n## Security categories\n# Product Properties\n## Memory-unsafe language risks\n## Memory safety roadmap expectations","[{\"question\":\"Who issued this Product Security Bad Practices guidance and who is it for?\",\"answer\":\"The guidance was developed by CISA and the Federal Bureau of Investigation (FBI). It is intended for software manufacturers that develop software products and services, including on-premises software, cloud services, SaaS, and software used on operational technology or embedded systems.\"},{\"question\":\"What are the three categories of bad practices described in the document?\",\"answer\":\"The bad practices are divided into three categories: Product properties, Security features, and Organizational processes and policies.\"},{\"question\":\"Is this guidance legally binding on manufacturers?\",\"answer\":\"No. The guidance is non-binding; it encourages avoiding the listed bad practices but imposes no requirement to do so.\"}]","Product Security Bad Practices - Version 2 - January 2025 | PDF",1791930358]