Wiz Outlines Security Controls Supporting CISA’s Secure by Design Pledge
Summary
Wiz describes how it says its products and processes address CISA’s Secure by Design commitments, including authentication controls, memory-safe languages, customer audit logs, software supply-chain safeguards and vulnerability reporting.
Key points
- Wiz says it supports SAML SSO, requires MFA for customers using direct authentication, and does not use default passwords.
- The company says service accounts can use short-lived API tokens, granular permissions and custom expiry dates.
- Wiz says its back end uses Go and its runtime sensor uses Rust, and that its GraphQL endpoint enforces schema and input validation.
- Wiz reports providing customers with security audit logs retained in its portal for 180 days, with options to send them to a SIEM or data warehouse.
- The company says it scans software components and provides customers with SBOM inventory features for components found across connected cloud environments.
- Wiz says its vulnerability management policy defines customer-impact SLAs, and that it maintains a bug bounty program and shares patched vulnerability details in release notes.
Article Details
- Event Type
- Wiz update on its implementation of the CISA Secure by Design Pledge
- Impact
- Wiz describes security measures for its SaaS products, including mandatory multi-factor authentication for direct logins, least-privilege permissions, memory-safe implementation languages, audit logs, software-component scanning, vulnerability-management processes, and customer access to SBOM inventory and security documentation. The article reports no security incident or customer impact.