# Security by Design

Record: `arch:security-by-design`
Kind: principle
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: system, service, codebase
Canonical: https://banes-lab.com/ontology#arch-security-by-design

## Repair

- Refactored by: Add Security Boundary, Validate Input, Enforce Access
- Detected by: missing authz/input validation/threat model
- Violated by: security controls added only at perimeter
- Measured by: security control coverage
- Enforced by: security gates, [policy-as-code](https://banes-lab.com/records/arch/policy-as-code.md)

## requires

- [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md)
- [Secure Defaults](https://banes-lab.com/records/lex/secure-defaults.md)

## reinforces

- [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md)
- [Compliance](https://banes-lab.com/records/arch/compliance.md)

## enables

- [Proactive Risk Reduction](https://banes-lab.com/records/lex/proactive-risk-reduction.md)

## conflicts-with

- [Security as Afterthought](https://banes-lab.com/records/lex/security-as-afterthought.md)

## tensions-with

- [Developer Ergonomics](https://banes-lab.com/records/lex/developer-ergonomics.md)

## tensions

- [Security by Design Developer Ergonomics](https://banes-lab.com/records/tension/developer-ergonomics-security-by-design.md)

## referenced-by

- [Fail Secure](https://banes-lab.com/records/arch/fail-secure.md)
- [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md)
- [Attack Surface Reduction](https://banes-lab.com/records/arch/attack-surface-reduction.md)
- [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md)
- [Risk Management](https://banes-lab.com/records/arch/risk-management.md)