Overview
4. Design
Referring to the Secure Product Design Cheat Sheet, the purpose of secure architecture and design is to ensure that all products meet or exceed the security requirements laid down by the organization, focusing on the security linked to components and technologies used during the development of the application.
Secure Architecture Design looks at the selection and composition of components that form the foundation of the solution. Technology Management looks at the security of supporting technologies used during development, deployment and operations, such as development stacks and tooling, deployment tooling, and operating systems and tooling.
A secure design will help establish secure defaults, minimize the attack surface area and fail securely to well-defined and understood defaults. It will also consider and follow various principles, such as:
- Least Privilege and Separation of Duties
- Defense-in-Depth
- Zero Trust
- Security in the Open
A Secure Development Lifecycle (SDLC) helps to ensure that all security decisions made about the product being developed are explicit choices and result in the correct level of security for the product design. Various secure development lifecycles can be used and they generally include threat modeling in the design process.
Checklists and Cheat Sheets are an important tool during the design process; they provide an easy reference of knowledge and help avoid repeating design errors and mistakes.
Software application Design is one of the major business functions described in the Software Assurance Maturity Model (SAMM), and includes security practices:
The OWASP Developer Guide is a community effort; if there is something that needs changing then submit an issue.