Cybersecurity
NTIA’s cybersecurity multistakeholder processes, conducted in an open and transparent manner, contribute to the security of the nation’s Internet architecture. The consensus-based development of market-based cybersecurity solutions and guidance creates a foundation for increasing digital security. Recent processes include:
- Software component transparency -- creating guidance for the use of a “Software Bill of Materials,” which functions as a list of ingredients that make up software components
- Internet of Things security – addressing key aspects of IoT security, including upgradability and patchability of connected devices
- Cybersecurity vulnerability disclosures – increasing collaboration between security researchers and software and system developers and owners
Related content
Notice of Extension of Comment Period on Promoting Stakeholder Action Against Botnets and Other Automated Threats
Request for Comments on Promoting Stakeholder Action Against Botnets and Other Automated Threats
NTIA, on behalf of the Department of Commerce, is requesting comment on actions that can be taken to address automated and distributed threats to the digital ecosystem as part of the activity directed by the President in Executive Order 13800, “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.” Through this Request for Comments, NTIA seeks broad input from all interested stakeholders – including private industry, academia, civil society, and other security experts – on ways to improve industry’s ability to reduce threats perpetuated by automated distribu
Improving Cybersecurity Through Enhanced Vulnerability Disclosure
Stakeholders involved in NTIA’s cybersecurity multistakeholder process to promote collaboration on vulnerability research disclosure today are releasing initial findings, recommendations, and resources that they hope will enhance cooperation and lead to a more secure digital ecosystem. The three stakeholder-drafted reports reflect the experience and wisdom of many of the key experts in the field, including active security researchers, experienced software companies, security companies, academics, and civil society advocates, as well as industries new to the issue.
Vulnerability disclosure has long been an open, important issue in cybersecurity. Companies need a strategy to deal with flawed software, systems, and configurations -- especially when the issues are first discovered by a third party. Without a strategy, for example, companies sometimes choose to threaten the third party with legal action rather than working together to fix the vulnerability. This need is heightened as more and more organizations become part of the digital economy.
A diverse set of stakeholders participated in this process for more than a year, attending four in-person meetings across the country, and participating in countless conference calls and drafting sessions. On behalf of NTIA, I want to thank them for their hard work and dedication to seeking consensus and increased collaboration on these important cybersecurity issues.