Secure by Design Must Lead Software Development

Software supply chain attacks have increased, exposing gaps in application security strategies. Many organizations still rely on outdated testing methods and fail to monitor open-source threats effectively.

See Also: From Silos to Synergy: Gen AI Aligns IT and Security Teams

To strengthen defenses, they must adopt secure-by-design practices, select mature open-source components and embed risk awareness throughout development, according to Cassie Crossley, vice president of supply chain security for the cybersecurity and product security office at Schneider Electric.

Crossley said organizations need to evaluate the security posture of both their internal processes and suppliers. “As software developers, we’re not necessarily trained on cybersecurity and that part of the process, which is the secure by design.” Secure coding must begin to include protection for containers, build environments and deployment systems, she said.

Crossley recommends using the NIST Secure Software Development Framework with ISO-certified disclosure policies. She also recommends better tooling to ingest software bills of materials and perform continuous analysis. Although artificial intelligence tools have improved visibility, integration into asset and risk management systems remains a work in progress, she said.

In this video interview with Information Security Media Group, at Nullcon Goa 2025, Crossley also discussed:

• Why secure coding practices are especially critical for startups without formal security programs;
• Why bridging the gaps between CISOs, supply chain heads and other teams is still a challenge;
• The need for prioritizing the analysis of internet-facing assets and known exploitable risks.

Crossley is an experienced cybersecurity technology executive in information technology and product development and author of “Software Supply Chain Security: Securing the End-to-End Supply Chain for Software, Firmware, and Hardware.” She has many years of business and technical leadership experience in supply chain security, cybersecurity, product and application security, software and firmware development, program management, and data privacy.