Secure by Design, by Default, in Deployment (SD3)

Principle: The default settings of a system or application are configured with strong security measures in place. Systems should be configured in a least-privilege model so that no unnecessary services, daemons, or accounts are enabled.

Secure Default Configurations

• Ship products with secure defaults that protect users without requiring manual hardening
• Generate unique keys and secrets during first run or installation, not at build time
• Encourage users to review and customize settings, but ensure the uncustomized state is safe
• Minimizes risk from users or administrators who overlook or delay security configuration

Fail Secure

• Design services to fail closed: when they fail, they deny access rather than granting it
• A security service that cannot be reached must result in a denied request, not an open door
• Apply this to authentication, authorization, input validation, and configuration loading

Secure Baselines