# Security by Design

> A design rule that threats are modeled and controls built into every component from its first design.

Record: `architecture:security-by-design`
Kind: principle
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: system, service, codebase
Canonical: https://banes-lab.com/ontology#architecture-security-by-design

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Database Normalization](https://banes-lab.com/records/architecture/database-normalization.md) and before [Defense in Depth](https://banes-lab.com/records/architecture/defense-in-depth.md).

## Repair

- Refactored by: Add Security Boundary, Validate Input, Enforce Access
- Detected by: missing authz/input validation/threat model
- Violated by: security controls added only at perimeter
- Measured by: security control coverage
- Enforced by: security gates, [policy-as-code](https://banes-lab.com/records/architecture/policy-as-code.md)

## Requires

- [Threat Modeling](https://banes-lab.com/records/architecture/threat-modeling.md)
- [Secure by Default](https://banes-lab.com/records/architecture/secure-by-default.md)

## Reinforces

- [Defense in Depth](https://banes-lab.com/records/architecture/defense-in-depth.md)
- [Compliance](https://banes-lab.com/records/architecture/compliance.md)

## Enables

- [Proactive Risk Reduction](https://banes-lab.com/records/lexicon/proactive-risk-reduction.md)

## Conflicts with

- [Security as Afterthought](https://banes-lab.com/records/lexicon/security-as-afterthought.md)

## In tension with

- [Developer Ergonomics](https://banes-lab.com/records/lexicon/developer-ergonomics.md)

## Tensions

- [Security by Design / Developer Ergonomics](https://banes-lab.com/records/tension/developer-ergonomics-security-by-design.md)

## Contracts

- [Security Core](https://banes-lab.com/records/algorithms/security-core.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Reinforced by

- [Fail Secure](https://banes-lab.com/records/architecture/fail-secure.md)
- [Attack Surface Reduction](https://banes-lab.com/records/architecture/attack-surface-reduction.md)
- [Risk Management](https://banes-lab.com/records/architecture/risk-management.md)

## Linked from

- [Error Handling / Resilience](https://banes-lab.com/ontology/principles/architecture-category-error-handling-resilience.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Architectural Clusters](https://banes-lab.com/ontology/algorithms/algorithms-domain-architectural-clusters.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)