The Cost of Innovation: Complexities of Software Regulation
summary
The government launches a concrete implementation plan adding 31 initiatives to a prior 69 and explicitly explores a software liability regime to shift costs back to manufacturers; procurement now requires a CISA attestation form (live about six weeks) with a FAR rule forthcoming. Key specifics: self‑attestation ties to contracts, SSDF-focused processes, insurers and a possible federal backstop as incentives, startups face multi-year, multi‑person overhead to sell to government (example: six security and three docs for two years), and only ~1–3% of vulnerabilities are actively discovered so resilience over perfect security is emphasized.
AI-written summary · about
chapters (12)
- 0:00Software regulation challenges
- 1:31Cybersecurity strategy updates
- 6:53Existing regulation frameworks
- 8:41Regulation impact on users
- 11:33Innovation versus secure development
- 15:24Procurement and software liability
- 21:07Attestation and liability effectiveness
- 26:53Risk management in security standards
- 31:07Q&A on cyber insurance
- 38:54Federal liability discussions
- 41:44Global regulatory trends
- 46:45Summary
related talks
16mCyber Resilience Act, already too late to comply?
31mThe Product Security Imperative: Lessons from CISA
13mNavigating the complex and rapidly evolving world of product and application security regulations
24mThe CRA Challenge: Can Open Source and IoT Stay Agile Under Regulation?
44mThey're coming to regulate you!
50mRunning in the Shadow: Perspectives on Securing the Software Supply Chain
54mThe CRA, Where Are We Six Months After Its Approval
15mKeynote: Government's Continuing Path Contributing Towards a Secure Open Source Ecosystem