The principles that design safety

Only as much as needed, least privilege

Earlier in the operating system lessons we saw access being taken back.
Let's widen that idea into security design.
When you grant someone access,
give only as much as the task truly needs.
For someone who only needs to look for a moment,
there is no reason to also grant the power to change.
And when the task is done, take that access back.
The less access held, the smaller the range
that anything going wrong can spread to.
The more you hand out, the more there is to lose.

Choose how much access to give one person. Just enough keeps the risk small, too much makes more to lose.

Giving just enough was the cleanest.
Excess access may look convenient day to day,
but the moment something goes wrong it grows the damage.
Least privilege is not for people only.
It applies the same to programs and to machines.
Let this part do only this one job.
Let this program see only this one folder.
Fence the access in narrowly like that.
But even with access well divided,
a day comes when that one layer is breached.
So the next principle is needed.

Even if one breaks, defense in depth

No defense can promise it will never be breached.
So we do not stake everything on a single layer.
We stack several blocking layers.
The outer door may open, but there is an inner door,
the inner door may open, but there is a safe.
Even if one layer fails,
the layer behind it catches.
What used to mean breaking through one spot
now means breaking through every layer.
The more layers, the harder it is to reach the end.
That is the strength of defense in depth.

Break through the layers one by one. Even when one opens, the next blocks, so reaching the end means passing every layer.

Opening one layer was not the end.
The next layer blocked again.
There is a knack to placing several layers.
Make each layer different in nature.
If every layer were the same lock,
knowing how to open one would be knowing how to open all.
Layers are sturdier the more their kinds differ.
But to set up several layers,
you must clearly decide
how far to let in and where to start blocking.
The starting point of that decision is the next principle.

Block the unknown, default deny

When designing a door, you can start from two points.
One is to let everything in and block only the bad.
The other is to block everything and let in only the allowed.
Between the two, starting from blocked is safer.
If you start by letting all in,
even dangers you never thought of get in.
You would have to know every bad thing in the world to block them.
Starting from blocked, by contrast,
only what you clearly allowed passes.
The unknown is blocked automatically.
If you are not on the list, you do not get in.

Compare the two starting points. Letting all in and blocking the bad leaks unknown danger, blocking all and allowing a few blocks the unknown automatically.

On the side that started by letting all in,
an unforeseen guest quietly leaked through.
The side that started blocked stopped everything unknown.
With default set to deny,
even if you miss something off the allow list,
you lean toward the safe side, not the dangerous one.
It is designing so a mistake costs little.
We have seen three principles so far.
But trying to honor every principle
often makes the design grow complicated.
That becomes a danger of its own.
The last principle holds that balance.

Complexity grows gaps, the simpler the safer

If, in the name of honoring principles,
you keep bolting on more devices, what happens?
The more complicated the structure,
the more hidden gaps grow inside it.
The more parts and the more tangled the connections,
the harder it is to see at a glance where the weak spot is.
A structure no one can fully inspect
turns the uninspected spot into a gap.
So good design keeps simplicity.
Keep only as much as is truly needed
and pare away what can be done without.
When it is simple, you can see at a glance
what blocks what, and that is safer.

Add or remove parts in the structure. The more complex, the more unchecked gaps grow; the simpler, the easier to inspect at a glance.

Paring parts away shrank the places to inspect.
The more you bolted on, the more gaps quietly grew.
Simplicity is not laziness.
It is rather the result of weighing to the end
what is truly needed.
The four principles do not run apart;
they mesh and turn together.
Reduce with least privilege,
brace with several layers,
set the default to deny,
and keep the whole of it simple.
Now let's gather the four principles in one place.

Let's wrap up

Gathered in one place, it is this.
Good security comes not from one technology but from design principles.
Least privilege: give only as much as needed, take it back when done.
Defense in depth: even if one breaks, the next layer braces.
Default deny: block everything except what is allowed.
The simpler the safer: complexity grows gaps.
The four principles mesh and turn together.
And these principles last longer than individual techniques.
So even when you meet a new technology,
weighing it by the principles first keeps you steady.

Tap the four principles in order to review. (least privilege -> defense in depth -> default deny -> the simpler the safer)

Now you hold the four principles that design safety.
When you meet other security stories ahead,
these principles will serve as a guide.
Was this given only as much as someone needs?
Is this just one layer, or several?
Does this let the unknown in, or block it?
Is this simple, or needlessly complicated?
The names of technologies keep changing,
but these questions always carry through.
An eye that weighs by principles is the power to see security.