Secure Design Principles

Question 1

Zero trust

Answer 1

Secure design relationship principle. There is no default privilege. Verification is required for access

Question 2

Trust but verify

Answer 2

Security design relationship principle - dependencies are not trusted until proven trustworthy

Question 3

Least privilege

Answer 3

Giving a subject or process only the rights and permissions needed to complete assigned tasks

Question 4

Survivability

Answer 4

Is a system property system ability to prevent, mitigate and recover from cyber events. We have 3 sets of secure design principles:
1. Planning principles
2. Configuration principles
3. Relationship principles

Question 5

Open design

Answer 5

Secure design planning principle, the security mechanism should not depend upon the secrecy of the design or implementation.

Question 6

Default deny

Answer 6

Secure design planning principle, where base access decisions are made by permission rather than exclusion. By default access denied, and the protection schemes identifies conditions under which access is permitted

Question 7

Psychological acceptance

Answer 7

Secure design relationship principle, human inference should be designed easy to use , so that users routinely and automatically apply the protection mechanisms correctly

Question 8

Least functionality

Answer 8

Secured design configuration principle, systems and devices should be configured to provide only essential capabilities, and specifically prohibit or restrict the use of unnecessary functions, ports, protocols, services

Question 9

Separation of duties

Answer 9

Security design relationship principle, braking a task into segments so that no one subject is in complete control or has complete decision-making power

Question 10

Fail secure

Answer 10

Security design planning principle, in the event of failure access is denied (secured)

Question 11

Defense in depth

Answer 11

Secure design configuration principle, utilizes multiple layers of diverse controls including endpoint protection such as host-based firewall.

Question 12

Threat modeling

Answer 12

Secure design planning principle, uses threat modeling to anticipate threats. Focus on undesirable consequences. This is potential dangerous and risk minimization

Question 13

Keep it simple

Answer 13

Security design planning principle, security mechanisms should be as simple as possible. Simplicity means fewer possibilities for error and the assessment process is less complex