Secure by Design

When it comes to cybersecurity, the best approach is to bake security right into the fabric of your systems, rather than slapping it on as an afterthought. Think of it like building a house: you would not skimp on the foundation and then try to reinforce it after the walls are up, right?

The same logic applies to building secure digital systems.

Why “Secure by Design” Matters

Retrofitting security into a system after it has been built is not only more expensive but also often less effective. Imagine realizing your house needs a basement after it is already built. Awkward and costly, right?

The same goes for security vulnerabilities.

The later you catch them in the development process, the more expensive they are to fix. So, the goal is to catch and address security concerns early—ideally, right from the design phase.

In this post, we will walk you through ten key principles of secure design. Think of them as the building blocks for a solid, secure foundation.

1. Principle of Least Privilege: Only What’s Necessary

The principle of least privilege is all about giving people the bare minimum access they need to do their jobs. If your job is to mow the lawn, you do not need the keys to the whole house.

This means, for example, that most employees might have access to general company information, but not the really sensitive stuff.

And for those who do need access to critical systems, make it temporary and only for as long as necessary.

The less access floating around, the smaller the target for attackers.

2. Defence in Depth: More Than One Layer of Protection

Imagine your security system as a medieval castle.

You would not just have a moat and call it a day. You would have walls, guards, and maybe even a dragon or two (Of course I would mention Dragons, I am Welsh after all).

Defence in depth works the same way. It means you are not relying on just one security measure but multiple, layered Defences.

If an attacker gets through one, they will have to get through another and another.

This could involve multi-factor authentication, firewalls, encrypted data, and more. Each layer is a hurdle that makes breaking in a whole lot harder.

3. Failsafe: Plan for the Worst

Let us be honest, things go wrong.

Systems fail, and that is okay, as long as they fail safely. Imagine a firewall that crashes.

What should it do?

The answer: block everything by default, even the good stuff, until it is fixed.

It is like a shopkeeper locking up if the alarm system malfunctions. It is inconvenient, but it is better than leaving the door wide open.

4. Keep It Simple, Stupid (KISS): Simplicity Is Your Friend

Complexity is the enemy of security.

The more complicated a system is, the harder it is to secure. Think of it like trying to untangle a mess of wires. The more tangled they are, the harder it is to find the faulty connection.

By keeping systems simple and straightforward, you reduce the chances of hidden vulnerabilities and make your life a lot easier.

5. Separation of Duties: Do not Put All Your Eggs in One Basket

This principle is like having two keys for a high-security vault—one person cannot open it alone.

It ensures that no single person or system has control over all the sensitive aspects of a system.

This way, even if one person goes rogue or their account gets compromised, there is a backup plan in place that requires more than one set of credentials to access critical systems.

6. Open Design: Transparency Over Secrecy

Security by obscurity is a false sense of security. It is like hiding your house key under the doormat—if that is your only security measure, you are in trouble.

Open design means the security of a system does not depend on keeping its inner workings secret.

Instead, it relies on well-designed, transparent mechanisms that are strong enough to withstand scrutiny.

7. Segmentation: Isolate and Protect

Segmentation is like having separate compartments on a ship. If one compartment floods, the others can stay dry.

In cybersecurity, segmentation means dividing your network into isolated sections so that if one part is compromised, the rest remain secure.

This approach is especially important for protecting sensitive data from less secure parts of a system.

8. Usability: Do not Fight Human Nature

At the end of the day, the most sophisticated security system is worthless if people do not—or cannot—use it properly.

If your password policy requires users to remember a complex string of characters that changes every week, chances are they will write it down on a sticky note and slap it on their monitor.

Make security easy for people to follow, and they will be less likely to find shortcuts that compromise it.

9. Minimize Attack Surface: Less Is More

This principle is about reducing the number of entry points into your system.

The fewer doors and windows you have, the fewer places an attacker can try to break in.

It is like having only one secure, well-guarded entrance to a building rather than a dozen.

This could mean disabling unnecessary features, limiting remote access, or removing outdated components.

10. Secure by Default: Out-of-the-Box Protection

When you buy a new device, you want it to be secure straight out of the box.

That means default settings should prioritize security. If a product comes with a default password, it should require you to change it before you can use it.

If it has unnecessary features, they should be disabled or removed.

The idea is to make the most secure setup the easiest option for the user.

Wrapping It Up

Getting security right is not easy, but by incorporating these principles from the get-go, you are building a fortress rather than just a house of cards.

Remember, security is not just a box to check off—it is a mindset.

When you design systems with security in mind from the start, you are not only protecting your data and your users but also saving yourself a lot of headaches down the road.

After all, it’s a lot easier to put out a campfire than to rebuild a city.

So, start secure, stay secure, and sleep a little easier at night.

Special thanks to Jeff Crume, PhD, CISSP on the IBM Technology Youtube Channel for his insightful video which inspired me to write this. You can see his amazing video here:

10 Principles for Secure by Design: Baking Security into Your Systems (youtube.com)