Security_Design_Principles_Presentation.pptx

Questions about the CIA Triad:
What is the CIA triad?
What does confidentiality mean in information security?
What does integrity mean in information security?
What does availability mean in information security?
Can you provide an example of a breach of confidentiality?
How can data integrity be protected?
Questions about the AAA Framework:
What is the AAA framework in information security?
What is the difference between authentication and authorization?
How is user activity logged and tracked?
What is the principle of "least privilege"?
Questions about Extended Principles:
What is the difference between authenticity and non-repudiation?
Why is accountability important in information security?
How does a digital signature contribute to non-repudiation?
Questions about Strategic Concepts:
What is defense in depth?
What are the different layers of defense used in a "defense in depth" strategy?
What is the role of risk management in information security?
What is information security governance?
General Questions:
What are the fundamental concepts of information security?
What are some core principles that modern information security relies on?

1. Security Design Principles An overview of key principles for building secure systems (Class Presentation)

2. Introduction Security Design Principles are basic rules for building secure systems. They protect data, prevent misuse, and reduce cyberattack risks. These apply to software, networks, and organizational security.

3. Least Privilege Give users only the access they need. Limits damage if an account is compromised. Example: A cashier can access sales data, not salaries.

4. Defense in Depth Use multiple layers of security for protection. If one layer fails, others still defend the system. Example: Firewall + antivirus + strong passwords.

5. Fail-Safe Defaults Deny access by default unless specifically allowed. Systems should stay secure even when errors occur. Example: Login errors should block access, not allow it.

6. Separation of Duties Divide responsibilities among different people or systems. Prevents fraud and insider misuse. Example: One person requests, another approves payment.

7. Economy of Mechanism Keep security systems simple and clear. Simple systems are easier to test and maintain. Example: Simple login systems reduce vulnerabilities.

8. Complete Mediation Check permissions every time a resource is accessed. Don’t assume access remains valid. Example: Verify access for every file read/write.

9. Open Design Security should not depend on hidden designs. Transparency helps experts find and fix weaknesses. Example: Open-source code allows public security review.

10. Least Common Mechanism Avoid sharing common resources unnecessarily. Reduces risk of one user affecting others. Example: Separate memory or file spaces per user.

11. Psychological Acceptability Security features should be easy to use. If too hard, users will ignore or disable them. Example: Use fingerprint or password managers.

12. Security by Design Include security in all stages of development. Identify threats early using threat modeling. Prevention is cheaper than fixing later.

13. Conclusion Security Design Principles build trust and reliability. They protect systems from attacks and misuse. Security should always be part of the design process.