content_image/483099.jpg
<img src='content_image/483099.jpg'>

and user of a system should operate using the least set of permissions and privileges necessary to complete their job. Primarily, this principle limits the damage that can result from unauthorised, unintentional or improper uses of privileges. A blatant example of the failure to adhere to the principle of least privilege is logging into Windows as Local Administrator to read email and browsing Internet. Violations of this principle can also occur when an individual collects additional access privileges over time 7 .While the principle is more related to (secure) software development and user access management, it is also applied in operating system hardening and network access control. 

## Protect the weakest link 

Overall security can be only as effective as the weakest link in the chain from end-to-end. Thus, the weakest link principle states that the whole chain should be adequately protected by similar level of protection. 

## Simplicity and standardisation 

As complexity is often an enemy of security and a friend of attackers, one of security principles is simplified architecture. Therefore unnecessary complexity, both from a design perspective and from an implementation perspective, should be avoided and the security mechanisms should be pervasive, simple, scalable, and easy to manage. 

While complexity increases the risk of problems, also the risk of security problems, it cannot be completely avoided. Also, the simplification may be a conflicting principle with the defence in depth and least privileges. If the principles have conflicts, a risk driven approach is applied to find a balance between the principles. 

## Continuous improvement 

As long as new threats and attack methods are evolving, and amount and therefore value of collected information is increasing, IT security must be continuously improved to sustain the state at the current, acceptable level. While operational level improvements happen frequently based on evolution of the threats, continuous improvements cover also mid- and long-term tactical and strategic security aspects. 

All the principles are applied by following the risk driven approach; For example, if a system stores lot of highly sensitive information, the defense in depth and least privileges principles are strictly applied. On the other hand, if a system requires lower level of protection 8 , the principle simplicity and standardization has a main role. Thus, for example, depth of defense, i.e. required number of independent protection layers, depends on system criticality and threats targeted. 

“ Secure Application Design and Development Guideline ” sets a security framework and principles for all ECHA IT projects where new systems or applications are designed or developed. It defines how security of the product to be developed is considered and implemented in different phases of the projects. Projects have to include in the requirements the security measures, based on the result of the risk assessment and take 

