Subscribe
About
  • Home
  • /
  • Networking
  • /
  • Fortinet reaffirms its commitment to secure product development processes, responsible vulnerability disclos...

Fortinet reaffirms its commitment to secure product development processes, responsible vulnerability disclosure policies

As one of the first cyber security vendors to sign CISA’s Secure by Design pledge, Fortinet furthers its dedication to a culture of responsible radical transparency with the safety of customers top of mind.

Johannesburg, 31 May 2024
Fortinet is committed to adhering to robust product security scrutiny.
Fortinet is committed to adhering to robust product security scrutiny.

Fortinet (NASDAQ: FTNT), which positions itself as the global cyber security leader driving the convergence of networking and security, has announced it is building on the company’s long-standing commitment to responsible radical transparency as an early signer of the Secure by Design pledge developed by the Cybersecurity and Infrastructure Security Agency (CISA).

This voluntary industry pledge complements and builds on existing Fortinet software security best practices, including those developed by CISA, NIST, other federal agencies and international and industry partners. The pledge outlines seven goals, including responsible vulnerability disclosure policies, which are already an integral part of Fortinet’s product security development.

Advancing Fortinet’s commitment to Secure by Design principles and responsible disclosure processes

CISA’s latest initiative strongly aligns to Fortinet’s existing product development processes already based on Secure by Design and Secure by Default principles. Fortinet is committed to adhering to robust product security scrutiny at all stages of the product development life cycle, helping to ensure that security is designed into each product from inception all the way through to end of life, in the following ways:

  • Secure product development life cycle (SPDLC): Fortinet aligns its processes in accordance with leading standards, including NIST 800-53, NIST 800-161, NIST 800-218, US EO 14028, and UK Telecom Security Act.
  • Robust security product testing: Fortinet leverages tools and techniques such as static application security testing (SAST) and software composition analysis built into its build processes, dynamic application security testing (DAST), vulnerability scanning and fuzzing prior to each release, as well as penetration testing and manual code audits.
  • Trusted supplier programme: To ensure rigorous selection and qualification of its major manufacturing partners, Fortinet adheres to NIST 800-161: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. Fortinet’s commitment to data privacy and security is embedded in every part of the company’s business and in every phase of the product development, manufacturing and delivery processes.
  • Information security programme: The Fortinet Information Security Program is based on and aligned with industry-leading security standards and frameworks, including ISO 27001/2, ISO 27017 and 27018, and NIST 800-53, as well as data privacy regulations such as GDPR and CCPA.
  • Third-party certifications: Fortinet products are regularly certified to standard and validated through third-party product quality standards, including NIST FIPS 140-2 and NIAP Common Criteria NDcPP / EAL4+.

Additionally, the Fortinet Product Security Incident Response Team (PSIRT) is responsible for maintaining security standards for Fortinet products and operates one of the industry’s most robust PSIRT programmes, including proactively and transparently disclosing vulnerabilities. Nearly 80% of Fortinet vulnerabilities discovered in 2023 were identified internally through the company’s rigorous auditing process. This proactive approach enables fixes to be developed and implemented before malicious exploitation can occur. Fortinet works with its customers, independent security researchers, consultants, industry organisations and other vendors to accomplish the company’s PSIRT mission.

To further advance its dedication to a culture of responsible radical transparency, Fortinet has a long-standing commitment to public and private partnerships that align to its mission, including:

  • Through its membership with the Joint Cyber Defense Collaborative (JCDC), which was established by CISA in 2021, Fortinet works with public and private entities to gather, analyse and share actionable information to more proactively protect and defend against cyber threats.

Jim Richberg, Head of Cyber Policy and Global Field CISO at Fortinet, said: “At Fortinet, we have a long-standing commitment to being a role model in ethical and responsible product development and vulnerability disclosure. As part of this dedication, Fortinet has proactively aligned to international and industry best practices and upholds the highest security standards in every aspect of our business. We applaud CISA’s continued call to the industry to follow suit and appreciate CISA’s willingness to collaborate with Fortinet on the development of these important goals. We strongly encourage others in the technology community to join this effort to keep organisations secure."

Michael Daniels, President and CEO of the Cyber Threat Alliance (CTA), noted: “Over and over, across multiple sectors, we have learned that transparency improves outcomes for consumers and society. The cyber security industry is no different. In our sector, transparency includes searching for, mitigating and disclosing vulnerabilities in an open, responsible manner. Fortinet has already taken steps to embrace such responsible transparency, creating a clear set of principles for handling vulnerability communication and analysis. The company’s leadership in this area is a strong example of how cyber security vendors should be communicating with customers and the broader public.”

Share

Fortinet

Fortinet (NASDAQ: FTNT) is a driving force in the evolution of cybersecurity and the convergence of networking and security. Our mission is to secure people, devices, and data everywhere, and today we deliver cybersecurity everywhere you need it with the largest integrated portfolio of over 50 enterprise-grade products. Well over half a million customers trust Fortinet's solutions, which are among the most deployed, most patented, and most validated in the industry. The Fortinet Training Institute, one of the largest and broadest training programs in the industry, is dedicated to making cybersecurity training and new career opportunities available to everyone. Collaboration with high-profile, well-respected organizations from both the public and private sectors, including CERTs, government entities, and academia, is a fundamental aspect of Fortinet’s commitment to enhance cyber resilience globally. FortiGuard Labs, Fortinet’s elite threat intelligence and research organization, develops and utilizes leading-edge machine learning and AI technologies to provide customers with timely and consistently top-rated protection and actionable threat intelligence. Learn more at https://www.fortinet.com, the Fortinet Blog, and FortiGuard Labs.