3. Secure by design and default principles

Secure by design focuses on incorporating security principles from the earliest stages of development. It requires organisations to embed security into the structure, logic and behaviour of a system rather than treating it as an afterthought. For the purposes of this playbook, secure by design is treated as a life-cycle approach. The principles are grouped into architectural foundations (how a system is built) and operational integrity (how it is managed and maintained) (Figure 2). These categories are practical organising lenses rather than mutually exclusive classifications, and some aspects of the principles contribute to both categories (17).

Figure 2: Secure by design principles

Secure by default complements secure by design by focusing on the product’s security configuration presented to the user. Even well-designed systems can become vulnerable if they are released with insecure or overly permissive default settings.

The goal of secure by default is to minimise the attack surface after deployment by ensuring that the most secure configuration is applied automatically (20). This includes disabling unnecessary services, applying restrictive access controls and providing clear information to users about the default security posture. Secure defaults reduce reliance on user expertise and limit the potential for misconfigurations, which are a common source of security incidents.

To summarise, secure by design focuses on how the system is engineered, while secure by default focuses on how the system arrives and behaves when the user first turns it on. We can organise secure by default into two distinct categories: default hardening and guided protection (Figure 3). These categories are practical organising lenses. Some principles contribute both to the product’s initial secure state and to maintaining that state during use.

Figure 3: Secure by default principles