White House Scraps 'Burdensome' Software Security Rules (securityweek.com)
- Reference: 0180703126
- News link: https://yro.slashdot.org/story/26/01/30/2041200/white-house-scraps-burdensome-software-security-rules
- Source link: https://www.securityweek.com/white-house-scraps-burdensome-software-security-rules/
> The White House has announced that software security guidance issued during the Biden administration has been [1]rescinded due to "unproven and burdensome" requirements that prioritized administrative compliance over meaningful security investments. The US Office of Management and Budget (OMB) has issued [2]Memorandum M-26-05 (PDF), officially revoking the previous administration's 2022 policy, 'Enhancing the Security of the Software Supply Chain through Secure Software Development Practices' (M-22-18), as well as the follow-up enhancements announced in 2023 (M-23-16).
>
> The new guidance shifts responsibility to individual agency heads to develop tailored security policies for both software and hardware based on their specific mission needs and risk assessments. "Each agency head is ultimately responsible for assuring the security of software and hardware that is permitted to operate on the agency's network," reads the memo sent by the OMB to departments and agencies. "There is no universal, one-size-fits-all method of achieving that result. Each agency should validate provider security utilizing secure development principles and based on a comprehensive risk assessment," the OMB added.
>
> While agencies are no longer strictly required to do so, they may continue to use secure software development attestation forms, Software Bills of Materials (SBOMs), and other resources described in M-22-18.
[1] https://www.securityweek.com/white-house-scraps-burdensome-software-security-rules/
[2] https://www.whitehouse.gov/wp-content/uploads/2026/01/M-26-05-Adopting-a-Risk-based-Approach-to-Software-and-Hardware-Security.pdf
Watch out for those buttery males! (Score:2, Interesting)
Remember the right wing is impervious to hypocrisy. They simply do not experience the combined emotions of shame and self-awareness that are associated with it.
Meanwhile Donald Trump continues to be the best investment Russia ever made. Did you hear we are funding insurgents in canada? That is a real sentence that I wrote that has real meaning and isn't just a shitpost.
Re: (Score:2)
> Did you hear we are funding insurgents in canada? That is a real sentence that I wrote that has real meaning and isn't just a shitpost.
Someone must have told him Alberta has half as much oil as Venezuela, and it’s a whole lot closer.
It was too hard for Putin to read Trumps email. (Score:2)
So they had to remove the firewall and complex passwords. Haha
Re: (Score:1)
I'm sure Trump sends email in bulk to Putin along with the Ukraine intel
Ho hum... (Score:4, Interesting)
This abdication of effort and responsibility isn't special. Throw it on the pile with the rest. Cyber security can compost alongside health care, environmental protection, consumer protection, financial watchdogging... the list is already so well populated that this one doesn't matter much in the grander scheme.
Tortured logic. (Score:3)
The reasoning is honestly just baffling. Apparently the old requirements "diverted agencies from developing tailored assurance requirements for software and neglected to account for threats posed by insecure hardware." by requiring that people keep track of what software they were actually using .
Aside from the...curious...idea that knowing what your attack surface looks like is a diversion from developing assurance requirements; the claim that the old policy about SBOMs is being revoked for not focusing on insecure hardware is odd both on the obvious point that basically anything with a sensible scope only focuses on certain issues and leaves other issues to be handled by other things and the only slightly less obvious issue that most 'insecure hardware', unless you've qualified for a really classy covert implant or have high sensitivity TEMPEST issues or something, is not actually hardware problems; but firmware problems; which are just software problems that aren't as visible; exactly the sort of thing that SBOMs help you keep an eye on.
Not like anyone expected better; but this is exceptionally poor work.
Re: (Score:2)
> The reasoning is honestly just baffling. Apparently the old requirements "diverted agencies from developing tailored assurance requirements for software and neglected to account for threats posed by insecure hardware." by requiring that people keep track of what software they were actually using .
It's definitely "organizational speak", but afaict the SBOM thing, and the attestations about the whole dependency tree is virtually impossible for the large majority of COTS systems, especially SaaS ones. Like actually doing what the old policy seems to claim that it wants would increase costs ten fold or 100 fold. So i think the thing getting repealed was not realistic and IS just a paper exercise of people exchanging lies, as well meaning as it was...
So i think it's maybe worthwhile to actually f
Cool. Out with one set of compliance BS (Score:1)
In with another.
What a fucking joke.
Yes there is such a thing as a secure environment and no, not everything needs to be zero trust and waste have its cpu cycles doing twenty kinds of saml requests.
Re: (Score:2)
> In with another.
I was in a DevOps position at my previous employer. We were running around like maniacs getting ready to comply with the old rules.
It's been a few years. I wonder if they ever got it squared away...
Responsible for their own security? (Score:2)
"Each agency head is ultimately responsible for assuring the security of software and hardware that is permitted to operate on the agency's network,"
If it's [1]not on your network [politico.com], there is no security issue.
[1] https://www.politico.com/news/2026/01/27/cisa-madhu-gottumukkala-chatgpt-00749361
A little background (Score:2, Interesting)
Trump isn't doing this on his own; there are valid criticisms of these memos. Here's a quick writeup (thanks Claude):
Analysis of OMB Memoranda M-22-18 and M-23-16
Who's criticizing these memoranda?
Industry and vendor concerns (from the implementation period):
[1]Suppliers and vendors faced variations in conformity assessment expectations from agency to agency, with each agency potentially taking different approaches to the self-attestations [nist.gov]. The attestation requirements had to be obtained for every major versio
[1] https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-ssdf
Re: (Score:2)
Thanks for the background. I too am shocked that vendors were whining about having to comply with security standards.
No, you're right -- it's TOTALLY a "valid" point that vendors shouldn't have had to attest to the security of a "major version change." Afterall, major version changes are known for minor changes in the platform's design.
And it's TOTALLY a "valid" point that Officers of companies signing the attestation shouldn't have to face criminal liability for willfully providing false or misleading i
Re: (Score:2)
Apparently you are not from the USA as you are TOTALLY using sarcasm which will TOTALLY go over the head of some here. As I see it not wanting to do due diligence or take responsibility for your work is totally on brand with the current US administration. Of course when they get pwned it will totally be Biden's fault.
Previous policies (Score:2)
Just imagine if the article or the summary had linked to the original policies, [1]Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (M-22-18)" [whitehouse.gov], as well as [2]the follow-up enhancements announced in 2023 (M-23-16) [whitehouse.gov]
so that readers could see that they weren't "universal, one-size-fits-all method of achieving [the security goal]", and that it was as usual a lie, one that will surely weaken our security posture to disastrous consequences.
[1] https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf
[2] https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18-Enhancing-Software-Security.pdf
just imagine if (Score:1)
This was actually my job at a previous employer and I actually know something about this, and I didn't form an opinion based on a cursory review of some links, like apparently you just did.
Yes, software security is a real problem these days. The xz debacle showed everyone where the real risks are. There are so many ways now to get backdoors injected into major open source projects by finding the tiniest vulnerability and social engineering the hell out of it -- in the case of xz they found a stable, basical
Major Meltdown Or Epic Explosion (Score:5, Interesting)
After reading about the latest hot AI agent platform, and it's complete lack of guardrails or security, I see this as step into a massive disaster.
I guess I'm getting old. I'm deeply disturbed by our immediate tech future.
Re: (Score:2)
> I see this as step into a massive disaster.
Yeah, let's hope that never happens. [1]Oh, wait. [wikipedia.org]
[1] https://en.wikipedia.org/wiki/United_States_government_group_chat_leaks
Re: (Score:3)
Well, XKCD dependency (https://www.explainxkcd.com/wiki/index.php/2347:_Dependency ) came out 5+ years ago and was already true for 10 years before that in all SaaS. And even in home rolled systems of banks, fintech and other mainstream and "sober" services, though idk about defense specifically.
And some aspects of things have gotten better, but there's still no way, afaik, for anyone to REALLY certify something like even a Linux distribution except in the sense of 'yeah we'll try to fix it when the C
Its definately not coming from security ppl. (Score:4, Interesting)
The thing with security is that its hard, and its annoying, and it grates on bosses who want to "move fast and break things".
Proper institutional IT security is less about keeping on top of the latest way to manipulate a malloc() to generate a buffer overflow, although thats ALSO important, and more about the procedures and practices in an organization. You got virus checkers and software solutions to handle the technical stuff, the hard part is to convince the damn receptionist to stop buying from spam mails, because THATS where most of the damage comes from.
And in an organization with thousands of people, thats going to mean procedures procedures and more procedures. You need regular audits to quantify what the risks are, what the vunerabilities are, and what is to be done to patch up those holes. You need training to teach people not to open unverified atttachments. You need up to date inventories on computers as well as a regulated and planned approach to keeping up to date with software patches, and making sure all of your software is licensed (The whole thing falls apart when ted from marketing is using a pirated version of photoshop). All of this is a lot of work, and its all essential if you dont want the chinese running rampage through your network.
But so many bosses I've had , have hated this stuff. Its not how they operated when the company was 5 guys in an industrial unit. Well, Mo' Money, Mo' Problems, what works for 5 guys will not work for 500 guys because everythings exponentially more complex now, and so are the stakes. And heres the thing, when you got a government stuffed with startup-guy posers who think they know how to run a business, they'll start thinking government departments with 20,000 employees should be run like a 5 guy start-up where the weekly payroll is paid off the bosses credit card.
You saw the height of this hubris with DOGE when they actually thought they could get 6-7 guys working for a couple of months to replace giant mainframe systems that had literal decades worth of code cruft. Yeah no, big-boy world doesnt work like that.
And you can't do security by just keeping Norton up to date, not when China is literally hiring hundreds of top tier hackers to break in and steal anything not nailed down.