Security by Design Skill

Purpose

Apply security by design principles to ensure security is integrated from the earliest stages of development, not bolted on as an afterthought.

Core Principles

1. Secure by Default

• Principle: Systems should be secure in their default configuration
• Application:
  • Default to HTTPS, never HTTP
  • Default to least privilege access
  • Default to encrypted communications
  • Default to secure password policies
  • Disable unnecessary features by default

2. Defense in Depth

• Principle: Multiple layers of security controls protect against single point of failure