A significant proportion of attacks on current systems are facilitated by the exploitation of vulnerabilities inherent in the underlying design of the technology concerned or components within it. As such, there is now significant focus on the issue of enabling Security by Design; building in the protection from the outset and avoiding vulnerabilities at source. Related initiatives are now in progress to deliver hardware technologies that would form the foundation for future devices, but questions remain over the understanding and readiness of potential adopters to recognize and implement the resulting approaches. This paper reports upon a survey that was undertaken as part of a funded project to investigate organizational awareness and acceptance of the Digital Security by Design (DSbD) concept. Detailed responses were received from over 70 UK-based organizations, with the respondents themselves largely coming from a security background and in strong general support of the principle of maintaining cyber security. As such, the findings provide a relevant insight into whether an already pro-security group would be willing to go further in terms of their security commitment. The findings reveal that while the generally positive perspective prevails, there is currently relatively limited awareness of DSbD itself, and a variety of challenges that may be faced in promoting the adoption in practice. At the same time, there is general support for more effort to be made to incentivize and to some extent require the use of DSbD-technology once it becomes more widely available.

Benson, V., Furnell, S., Masi, D. and Muller, T. (2021). Regulation, Policy and Cybersecurity: Hardware Security. Final Project Report. Discribe Hub+, September 2021. https://www.discribehub.org/commissioning-reports.

DCMS. (2018). Code of Practice for Consumer IoT Security. Department for Digital, Culture, Media and Sport, October 2018. https://assets.publishing.service.gov.uk/government/uploads/
system/uploads/attachment_data/file/971440/
Code_of_Practice_for_Consumer_IoT_Security_October_2018_V2.pdf

DSbD. (2022). “More companies across the UK join Digital Security by Design to test and learn from prototype cybersecurity technology”, Press Release, Digital Security by Design, 5 December 2022. https://www.dsbd.tech/blogs/press-release-more-companies-across-the-uk-join-digital-security-by-design-to-test-and-learn-from-prototype-cybersecurity-technology/

DSbD. (2023). “About Digital Security by Design”, Digital Security by Design. https://www.dsbd.tech/about/ (accessed 27 February 2023).

Ipsos. (2022). Cyber security in enterprise connected devices. Department for Digital, Culture, Media and Sport, 9 May 2022. https://www.gov.uk/government/publications/cyber-security-in-enterprise-connected-devices

Levine, E.V. (2021). “The Die Is Cast”, Communications of the ACM, 64(1), pp56-60.

NCSC. (2018). “Secure by Default”, National Cyber Security Centre, 7 March 2018. www.ncsc.gov.uk/information/secure-default

Srinidhi, B., Yan, J., and Tayi, G.K. (2015). “Allocation of resources to cyber-security: The effect of misalignment of interest between managers and investors”, Decision Support Systems, 75, pp49- 62.

Straub, D.W. and Welke. R.J. (1998). “Coping with systems risk: Security planning models for management decision making”, MIS Quarterly, 22, pp441-469.

Tomlinson, A., Parkin, S. and Shaikh, S.A. (2022). Drivers and barriers for secure hardware adoption across ecosystem stakeholders, Journal of Cybersecurity, Volume 8, Issue 1, https://doi.org/10.1093/cybsec/tyac009

Tversky, A. and Kahneman, D. (1974). Judgment under Uncertainty: Heuristics and Biases, Science, 185, pp1124- 1131.

UK Parliament. (2022). The Product Security and Telecommunications Infrastructure Act 2022. 6 December 2022. https://www.legislation.gov.uk/ukpga/2022/46/pdfs/
ukpga_20220046_en.pdf

Woodruff, J., Watson, R.N.M., Chisnall, D., Moore, S.W., Anderson, J., Davis, B., Laurie, B., Neumann, P.G., Norton, R., Roe, M. (2014). “The CHERI capability model: Revisiting RISC in an age of risk”. https://www.cl.cam.ac.uk/research/security/
ctsrd/pdfs/201406-isca2014-cheri.pdf