Secure by Default

Kind: principle

Layer: Security Core

Aliases: Secure Defaults

Record: architecture:secure-by-default

Severity: mandatory

Scope: configuration, API, product

Canonical: Ontology

A design rule that every setting ships in its most restrictive safe state, and weakening one requires an explicit opt-in.

Listed in Architecture principles, after Zero Trust Architecture and before Attack Surface Reduction.

Requires

• Safe Defaults

Reinforces

• Fail Secure

Enables

• Reduced Misconfiguration Risk

Conflicts with

• Insecure Defaults

In tension with

• Ease of Initial Use

Tensions

• Secure by Default / Ease of Initial Use

Violated by

• Insecure Defaults

Refactored by

• Default Deny

Severity

• mandatory

Category

• Security / Privacy / Compliance / Governance

Enforced by

• rules/eslint/no-inline-style-write.eslint.rule.ts
• rules/eslint/no-unsafe-switch.eslint.rule.ts

Required by

• Security by Design

Reinforced by

• Parameterized Queries

Linked from

• Fail at the boundary
• Systems built around a model
• Error Handling / Resilience
• Security / Privacy / Compliance / Governance
• Core Vocabulary
• Security Privacy Compliance
• Severity levels
• The resolutions