Security by Design
OWASP Security Design Principles
Apply these during design -- retrofitting security is 10-100x more expensive.
| # |
Principle |
Architect Action |
| 1 |
Security by Design |
Include security requirements in architecture documents |
| 2 |
Security by Default |
Ship restrictive defaults; require explicit opt-in for relaxed settings |
| 3 |
Defense in Depth |
Layer controls: WAF + input validation + output encoding + parameterized queries |
| 4 |
Fail Secure |
Deny access on error; closed-by-default network policies |
| 5 |
Least Privilege |
Scoped service accounts; time-limited tokens; minimum permissions |
| 6 |
Compartmentalize |
Network segmentation; separate databases per trust level |
| 7 |
Separation of Duties |
Separate deployment approval from code authorship |
| 8 |
Economy of Mechanism |
Minimize attack surface; simple, auditable security code |
| 9 |
Complete Mediation |
Check authorization on every request; no cached auth decisions |
| 10 |
Open Design |
Use published, peer-reviewed algorithms; no security-through-obscurity |
| 11 |
Least Common Mechanism |
Separate admin and user interfaces |
| 12 |
Psychological Acceptability |
Make the secure path the easy path; minimize user friction |
STRIDE Threat Modeling
Apply STRIDE to every component in a Data Flow Diagram (DFD). Four questions drive every session:
- What are we working on? (system model)
- What can go wrong? (threat identification)
- What are we going to do about it? (mitigation)
- Did we do a good enough job? (review)
STRIDE Reference
| Threat |
Violated Property |
Architectural Mitigation |
| Spoofing |
Authentication |
MFA, mutual TLS, certificate pinning, OAuth2+PKCE |
| Tampering |
Integrity |
Input validation, HMAC, parameterized queries, immutable infra |
| Repudiation |
Non-repudiation |
Tamper-evident logging (append-only), digital signatures, SIEM |
| Info Disclosure |
Confidentiality |
Encryption at rest+transit, least privilege, generic error messages |
| Denial of Service |
Availability |
Rate limiting, circuit breakers, auto-scaling, query complexity limits |
| Elevation of Privilege |
Authorization |
Least privilege, RBAC/ABAC, signed tokens verified server-side |
STRIDE per DFD Element
| DFD Element |
Most Relevant Threats |
| External Entity |
Spoofing |
| Process |
All six STRIDE threats |
| Data Store |
Tampering, Info Disclosure, Repudiation, DoS |
| Data Flow |
Tampering, Info Disclosure, DoS |
| Trust Boundary |
Spoofing, Tampering, Elevation of Privilege |
Risk Response Options
| Response |
When |
Example |
| Mitigate |
Probable and impactful; controls feasible |
Add MFA for spoofing on admin login |
| Eliminate |
Remove feature/component entirely |
Remove unused admin API endpoint |
| Transfer |
Better managed by another party |
Use managed IdP (Auth0, Cognito) |
| Accept |
Low risk; mitigation cost exceeds impact |
Accept DoS risk on internal status page |
OWASP Top 10 -- Architectural Prevention
Focus on what the architect decides at design time, not implementation details.
A01: Broken Access Control (61% of breaches)
- Deny by default -- no endpoint open unless explicitly granted
- Centralized authorization service (OPA, Casbin, Cedar), not scattered checks
- Resource-level ownership -- queries scoped to authenticated user
- ABAC over simple RBAC for complex multi-tenant systems
- CORS with explicit origin allowlists -- never wildcards with credentials
A02/A05: Security Misconfiguration (rose to #2 in 2025)
- Infrastructure as Code with security scanning (tfsec, checkov) in CI/CD
- Hardened base images -- minimal containers with security baked in
- Configuration drift detection with automated alerting
- Environment parity -- same hardening across dev/staging/prod
A03: Injection (SQL #2 in CWE Top 25 2025)
- Parameterized queries everywhere -- reject PRs with string concatenation in SQL
- Treat ALL database-sourced data as potentially tainted (second-order injection)
- Allowlisting for dynamic query elements (table names, sort columns)
- Template sandboxing -- user input as DATA, never as template source
A04: Insecure Design (new in 2021)
- Mandate STRIDE analysis as gate for architecture reviews
- Abuse cases alongside every user story ("As an attacker, I want to...")
- State machines with explicit transitions for business logic
- Rate limiting built into architecture from day one
A06/Supply Chain (expanded in 2025)
- SCA scanning on every commit (Snyk, Dependabot)
- SBOM generation as build artifact
- Private package registry; block direct public pulls in production builds
- Lock files committed with integrity hash verification
A07: Authentication Failures
- Centralized IdP (Keycloak, Auth0, Cognito) -- no custom auth per service
- MFA required for sensitive data access and admin functions
- Progressive delays on failed attempts (exponential backoff, not permanent lockout)
- Session ID regeneration on every authentication state change
Secure Architecture Patterns
Zero Trust
Core: "Never trust, always verify" -- no implicit trust from network location.
| Component |
Implementation |
| Identity verification |
OAuth2/OIDC for users; mTLS for services |
| Transport security |
mTLS everywhere; service mesh (Istio, Linkerd) |
| Micro-segmentation |
Network policies limiting service-to-service |
| Continuous verification |
Re-authenticate and re-authorize every request |
| Least privilege access |
Scoped tokens; just-in-time access |
Input Validation Pipeline
User Input
-> Validation (allowlist, type, length, format)
-> Business Logic (parameterized queries, ORM)
-> Output Encoding (context-aware: HTML, JS, URL, CSS)
-> Client
Key: input validation is complementary, not primary defense. Output encoding prevents XSS. Parameterized queries prevent SQLi. Validation adds defense in depth.
Secrets Management
| Pattern |
Implementation |
| Centralized vault |
HashiCorp Vault, AWS Secrets Manager, Azure Key Vault |
| Sidecar injection |
Vault agent injects secrets into pods at runtime |
| Encrypted in repo |
SOPS + KMS for GitOps workflows |
| Pre-commit scanning |
gitleaks or TruffleHog blocks secrets before they reach git |
Rules: never in source code | never in container images | rotate automatically | separate per environment | audit all access.
Required HTTP Security Headers
| Header |
Value |
Purpose |
| Content-Security-Policy |
Strict nonce-based |
Prevent XSS |
| Strict-Transport-Security |
max-age=63072000; includeSubDomains; preload |
Force HTTPS |
| X-Content-Type-Options |
nosniff |
Prevent MIME sniffing |
| X-Frame-Options |
DENY or SAMEORIGIN |
Prevent clickjacking |
| Referrer-Policy |
strict-origin-when-cross-origin |
Control referrer |
| Permissions-Policy |
Feature-specific |
Limit browser APIs |
Security Testing in CI/CD
| Type |
Tests |
Pipeline Stage |
Tools |
| SAST |
Source code vulnerabilities |
Every commit/PR |
Semgrep, CodeQL, SonarQube |
| SCA |
Dependency CVEs |
Build stage |
Snyk, Dependabot, Trivy |
| DAST |
Running application |
Staging |
OWASP ZAP, Burp Suite |
| Secrets |
Leaked credentials |
Pre-commit + CI |
gitleaks, TruffleHog |
Strategy: SAST pre-commit (fast) -> SCA at build -> container scan -> DAST on staging -> block on critical/high findings.
API Security Checklist (OWASP API Top 10)
| # |
Threat |
Architect Decision |
| API1 |
BOLA (~40% of API attacks) |
Object-level authorization in service layer, not just routes |
| API4 |
Unrestricted resource consumption |
Rate limiting per-object, not just per-endpoint |
| API5 |
BFLA |
Separate admin and user API surfaces |
| API6 |
Sensitive business flow abuse |
State machine enforcement, idempotency keys |
| API9 |
Improper inventory management |
API versioning with sunset policies; deprecate old versions |
| API10 |
Unsafe API consumption |
Never trust third-party API responses; validate and sanitize |
GraphQL-Specific
- Disable introspection in production
- Set maximum query depth (10 levels) and complexity limits
- Limit batch size; exclude sensitive operations from batching
- Field-level authorization in resolvers
Defensive Coding Patterns (Cross-Reference for Crafters)
| Risk |
Vulnerable Pattern |
Secure Alternative |
| SQL Injection |
f"SELECT * FROM users WHERE name = '{name}'" |
Parameterized: cursor.execute("... WHERE name = %s", (name,)) |
| Deserialization |
pickle.loads(untrusted) |
json.loads(untrusted) or Pydantic schema validation |
| Command Injection |
os.system(f"cmd {input}") |
subprocess.run(["cmd", input], shell=False) |
| SSTI |
Template(user_input) |
env.from_string(trusted).render(data=user_input) |
| Mass Assignment |
User(**request.json()) |
DTO with explicit fields, server-set for sensitive |
| TOCTOU Race |
Read-check-write in separate steps |
Atomic conditional update (UPDATE ... WHERE condition) |
| Prototype Pollution (JS) |
Object.assign(target, untrusted) |
Map, null-prototype objects, strict schema validation |
1---2name: nw-security-by-design-23description: Security design principles, STRIDE threat modeling, OWASP Top 10 architectural mitigations, and secure patterns. Load when designing systems or reviewing architecture for security.4---56# Security by Design78## OWASP Security Design Principles910Apply these during design -- retrofitting security is 10-100x more expensive.1112| # | Principle | Architect Action |13|---|-----------|-----------------|14| 1 | Security by Design | Include security requirements in architecture documents |15| 2 | Security by Default | Ship restrictive defaults; require explicit opt-in for relaxed settings |16| 3 | Defense in Depth | Layer controls: WAF + input validation + output encoding + parameterized queries |17| 4 | Fail Secure | Deny access on error; closed-by-default network policies |18| 5 | Least Privilege | Scoped service accounts; time-limited tokens; minimum permissions |19| 6 | Compartmentalize | Network segmentation; separate databases per trust level |20| 7 | Separation of Duties | Separate deployment approval from code authorship |21| 8 | Economy of Mechanism | Minimize attack surface; simple, auditable security code |22| 9 | Complete Mediation | Check authorization on every request; no cached auth decisions |23| 10 | Open Design | Use published, peer-reviewed algorithms; no security-through-obscurity |24| 11 | Least Common Mechanism | Separate admin and user interfaces |25| 12 | Psychological Acceptability | Make the secure path the easy path; minimize user friction |2627## STRIDE Threat Modeling2829Apply STRIDE to every component in a Data Flow Diagram (DFD). Four questions drive every session:301. What are we working on? (system model)312. What can go wrong? (threat identification)323. What are we going to do about it? (mitigation)334. Did we do a good enough job? (review)3435### STRIDE Reference3637| Threat | Violated Property | Architectural Mitigation |38|--------|-------------------|--------------------------|39| **Spoofing** | Authentication | MFA, mutual TLS, certificate pinning, OAuth2+PKCE |40| **Tampering** | Integrity | Input validation, HMAC, parameterized queries, immutable infra |41| **Repudiation** | Non-repudiation | Tamper-evident logging (append-only), digital signatures, SIEM |42| **Info Disclosure** | Confidentiality | Encryption at rest+transit, least privilege, generic error messages |43| **Denial of Service** | Availability | Rate limiting, circuit breakers, auto-scaling, query complexity limits |44| **Elevation of Privilege** | Authorization | Least privilege, RBAC/ABAC, signed tokens verified server-side |4546### STRIDE per DFD Element4748| DFD Element | Most Relevant Threats |49|-------------|----------------------|50| External Entity | Spoofing |51| Process | All six STRIDE threats |52| Data Store | Tampering, Info Disclosure, Repudiation, DoS |53| Data Flow | Tampering, Info Disclosure, DoS |54| Trust Boundary | Spoofing, Tampering, Elevation of Privilege |5556### Risk Response Options5758| Response | When | Example |59|----------|------|---------|60| Mitigate | Probable and impactful; controls feasible | Add MFA for spoofing on admin login |61| Eliminate | Remove feature/component entirely | Remove unused admin API endpoint |62| Transfer | Better managed by another party | Use managed IdP (Auth0, Cognito) |63| Accept | Low risk; mitigation cost exceeds impact | Accept DoS risk on internal status page |6465## OWASP Top 10 -- Architectural Prevention6667Focus on what the architect decides at design time, not implementation details.6869### A01: Broken Access Control (61% of breaches)7071- Deny by default -- no endpoint open unless explicitly granted72- Centralized authorization service (OPA, Casbin, Cedar), not scattered checks73- Resource-level ownership -- queries scoped to authenticated user74- ABAC over simple RBAC for complex multi-tenant systems75- CORS with explicit origin allowlists -- never wildcards with credentials7677### A02/A05: Security Misconfiguration (rose to #2 in 2025)7879- Infrastructure as Code with security scanning (tfsec, checkov) in CI/CD80- Hardened base images -- minimal containers with security baked in81- Configuration drift detection with automated alerting82- Environment parity -- same hardening across dev/staging/prod8384### A03: Injection (SQL #2 in CWE Top 25 2025)8586- Parameterized queries everywhere -- reject PRs with string concatenation in SQL87- Treat ALL database-sourced data as potentially tainted (second-order injection)88- Allowlisting for dynamic query elements (table names, sort columns)89- Template sandboxing -- user input as DATA, never as template source9091### A04: Insecure Design (new in 2021)9293- Mandate STRIDE analysis as gate for architecture reviews94- Abuse cases alongside every user story ("As an attacker, I want to...")95- State machines with explicit transitions for business logic96- Rate limiting built into architecture from day one9798### A06/Supply Chain (expanded in 2025)99100- SCA scanning on every commit (Snyk, Dependabot)101- SBOM generation as build artifact102- Private package registry; block direct public pulls in production builds103- Lock files committed with integrity hash verification104105### A07: Authentication Failures106107- Centralized IdP (Keycloak, Auth0, Cognito) -- no custom auth per service108- MFA required for sensitive data access and admin functions109- Progressive delays on failed attempts (exponential backoff, not permanent lockout)110- Session ID regeneration on every authentication state change111112## Secure Architecture Patterns113114### Zero Trust115116Core: "Never trust, always verify" -- no implicit trust from network location.117118| Component | Implementation |119|-----------|---------------|120| Identity verification | OAuth2/OIDC for users; mTLS for services |121| Transport security | mTLS everywhere; service mesh (Istio, Linkerd) |122| Micro-segmentation | Network policies limiting service-to-service |123| Continuous verification | Re-authenticate and re-authorize every request |124| Least privilege access | Scoped tokens; just-in-time access |125126### Input Validation Pipeline127128```129User Input130 -> Validation (allowlist, type, length, format)131 -> Business Logic (parameterized queries, ORM)132 -> Output Encoding (context-aware: HTML, JS, URL, CSS)133 -> Client134```135136Key: input validation is complementary, not primary defense. Output encoding prevents XSS. Parameterized queries prevent SQLi. Validation adds defense in depth.137138### Secrets Management139140| Pattern | Implementation |141|---------|---------------|142| Centralized vault | HashiCorp Vault, AWS Secrets Manager, Azure Key Vault |143| Sidecar injection | Vault agent injects secrets into pods at runtime |144| Encrypted in repo | SOPS + KMS for GitOps workflows |145| Pre-commit scanning | gitleaks or TruffleHog blocks secrets before they reach git |146147Rules: never in source code | never in container images | rotate automatically | separate per environment | audit all access.148149### Required HTTP Security Headers150151| Header | Value | Purpose |152|--------|-------|---------|153| Content-Security-Policy | Strict nonce-based | Prevent XSS |154| Strict-Transport-Security | `max-age=63072000; includeSubDomains; preload` | Force HTTPS |155| X-Content-Type-Options | `nosniff` | Prevent MIME sniffing |156| X-Frame-Options | `DENY` or `SAMEORIGIN` | Prevent clickjacking |157| Referrer-Policy | `strict-origin-when-cross-origin` | Control referrer |158| Permissions-Policy | Feature-specific | Limit browser APIs |159160## Security Testing in CI/CD161162| Type | Tests | Pipeline Stage | Tools |163|------|-------|---------------|-------|164| SAST | Source code vulnerabilities | Every commit/PR | Semgrep, CodeQL, SonarQube |165| SCA | Dependency CVEs | Build stage | Snyk, Dependabot, Trivy |166| DAST | Running application | Staging | OWASP ZAP, Burp Suite |167| Secrets | Leaked credentials | Pre-commit + CI | gitleaks, TruffleHog |168169Strategy: SAST pre-commit (fast) -> SCA at build -> container scan -> DAST on staging -> block on critical/high findings.170171## API Security Checklist (OWASP API Top 10)172173| # | Threat | Architect Decision |174|---|--------|--------------------|175| API1 | BOLA (~40% of API attacks) | Object-level authorization in service layer, not just routes |176| API4 | Unrestricted resource consumption | Rate limiting per-object, not just per-endpoint |177| API5 | BFLA | Separate admin and user API surfaces |178| API6 | Sensitive business flow abuse | State machine enforcement, idempotency keys |179| API9 | Improper inventory management | API versioning with sunset policies; deprecate old versions |180| API10 | Unsafe API consumption | Never trust third-party API responses; validate and sanitize |181182### GraphQL-Specific183184- Disable introspection in production185- Set maximum query depth (10 levels) and complexity limits186- Limit batch size; exclude sensitive operations from batching187- Field-level authorization in resolvers188189## Defensive Coding Patterns (Cross-Reference for Crafters)190191| Risk | Vulnerable Pattern | Secure Alternative |192|------|-------------------|-------------------|193| SQL Injection | `f"SELECT * FROM users WHERE name = '{name}'"` | Parameterized: `cursor.execute("... WHERE name = %s", (name,))` |194| Deserialization | `pickle.loads(untrusted)` | `json.loads(untrusted)` or Pydantic schema validation |195| Command Injection | `os.system(f"cmd {input}")` | `subprocess.run(["cmd", input], shell=False)` |196| SSTI | `Template(user_input)` | `env.from_string(trusted).render(data=user_input)` |197| Mass Assignment | `User(**request.json())` | DTO with explicit fields, server-set for sensitive |198| TOCTOU Race | Read-check-write in separate steps | Atomic conditional update (`UPDATE ... WHERE condition`) |199| Prototype Pollution (JS) | `Object.assign(target, untrusted)` | `Map`, null-prototype objects, strict schema validation |
nWave-ai