Igniting Change: A Conversation With Dr. Ron Ross

### Overview At InfoSec World 2025, host Mandy Logan spoke with Dr. Ron Ross, CEO of Ron Ross Secure and a NIST Fellow, following his keynote titled "Igniting Change." Dr. Ross reflected on the past four to five decades of cybersecurity development, emphasizing that the industry has reached a crucial crossroads. While organizational frameworks and controls have made substantial progress, securing the deeper, foundational components of modern systems has emerged as the next imperative challenge.

### Key Topics - **Above vs. Below the Waterline:** Dr. Ross contrasted organizational governance and risk frameworks ("above the waterline") with foundational engineering ("below the waterline"), which encompasses hardware, software, and firmware. He noted that commercial components are integrated into all 16 critical infrastructure sectors—such as healthcare pacemakers, water distribution, power grids, transportation, and weapon systems—making component-level trustworthiness essential. - **The Black Box and Expanding Attack Surfaces:** Consumers and CISOs rely on commercial off-the-shelf products without knowing what happens inside them. Rapid adoption of emerging technologies like AI applications and AI agent systems expands this attack surface, presenting growing vulnerability risks. - **Supply Chain Visibility and SBOMs:** Dr. Ross highlighted that current Software Bill of Materials (SBOM) definitions remain superficial. More depth is needed regarding software design, code library sourcing, open-source integration, and DevSecOps processes to identify malicious or weak code before it enters production. - **Workforce Diversity in Cybersecurity:** Having participated in the conference's Women in Cyber Summit, Dr. Ross discussed talent shortages and the vital need to attract women to STEM and cyber policy roles to introduce diverse perspectives.

### Technical Details Dr. Ross argued that because customers cannot re-engineer commercial black boxes, the tech industry must take primary responsibility for foundational security. Essential engineering practices include adopting memory-safe programming languages, enforcing design principles like least functionality and least privilege, and minimizing attack surface early in the development lifecycle. He compared software transparency to nutrition labeling in grocery stores and safety evolution in the automotive industry (e.g., seat belts, airbags, crumple zones, and brakes), arguing that fielding software without guardrails or clear labeling is unacceptable.

### Takeaways - **Vendor Accountability:** Industry vendors must be transparent about development and engineering hygiene rather than offloading vulnerability management to downstream customers and CISOs. - **Deeper SBOM Standards:** SBOM initiatives must evolve beyond basic inventories to shed light on build processes and library provenance. - **Shared Executive Responsibility:** Security breaches should be treated as senior leadership issues rather than solely blaming CISOs and ISSOs, who bear immense stress while managing rapidly changing enterprise environments.