Security by Design

Kind: principle

Layer: Security Core

Record: architecture:security-by-design

Severity: mandatory

Scope: system, service, codebase

Canonical: Ontology

A design rule that threats are modeled and controls built into every component from its first design.

Listed in Architecture principles, after Database Normalization and before Defense in Depth.

Requires

• Threat Modeling
• Secure by Default

Reinforces

• Defense in Depth
• Compliance

Enables

• Proactive Risk Reduction

Conflicts with

• Security as Afterthought

In tension with

• Developer Ergonomics

Tensions

• Security by Design / Developer Ergonomics

Contracts

• Security Core

Violated by

• Security as Afterthought

Refactored by

• Trust Boundaries
• Input Validation
• Access Control

Severity

• mandatory

Category

• Security / Privacy / Compliance / Governance

Reinforced by

• Fail Secure
• Attack Surface Reduction
• Risk Management

Linked from

• Error Handling / Resilience
• Security / Privacy / Compliance / Governance
• Security Privacy Compliance
• Architectural Clusters
• Severity levels
• The resolutions