Security by design

Security by design is the principle that security requirements are derived, implemented and verified throughout a system's development lifecycle rather than bolted on before release, and that systems ship in a secure configuration by default. It is often paired with the related idea of secure by default: the shipped state minimises attack surface (unnecessary services off, no default passwords, least-privilege defaults, encryption on) so that a user who changes nothing is still reasonably protected. The economic argument is well established: defects are far cheaper to remove early, and some architectural weaknesses - a flawed trust model, missing tenant isolation, an authentication scheme that cannot be retrofitted - cannot be patched later without redesign, which is why the discipline emphasises the requirements and design phases, not just secure coding.

In engineering practice this is operationalised through a secure development lifecycle (Microsoft SDL, OWASP SAMM, BSIMM as a maturity yardstick). Core activities include threat modelling during design (STRIDE to enumerate spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege; attack trees; data-flow diagrams with trust boundaries), abuse-case analysis alongside use cases, and the selection of proven design principles articulated by Saltzer and Schroeder in 1975 - economy of mechanism, fail-safe defaults, complete mediation, open design, least privilege, separation of privilege, least common mechanism and psychological acceptability. Later phases add secure coding standards, SAST and DAST in the pipeline, software composition analysis for dependencies, and security testing gates before release. NIST SP 800-160 Vol. 1 (Engineering Trustworthy Secure Systems) provides the systems-engineering framing.

The concept has moved from good practice toward obligation. GDPR Article 25 makes "data protection by design and by default" a legal requirement for personal-data processing, so privacy-relevant design decisions must minimise data and default to the most protective settings. The EU Cyber Resilience Act imposes essential cybersecurity requirements on products with digital elements, including secure-by-default configuration and vulnerability handling, with obligations phasing in and the reporting duties applying from 11 September 2026. CISA's international "Secure by Design" guidance further pushes the responsibility toward manufacturers rather than end users. NIS2 Article 21 reinforces the same expectation for essential and important entities.

A persistent misconception equates security by design with merely running a penetration test before launch; testing at the end validates but cannot substitute for design decisions already baked in, and a pentest that finds an architectural flaw usually finds it too late to fix cheaply. Another is treating "secure by default" as absolute - defaults reduce risk for the median deployment but cannot anticipate every environment, so documented hardening guidance still matters. Security by design differs from defence-in-depth (which layers runtime controls) in that it concerns how the system is conceived and built; the two are complementary, since good design decides where those layers belong.