text: How do you add Secure by Design into the remit of a product or service? Firstly, Secure by Design is a process, not a point solution. It covers every aspect of the creation of a solution. The 5 tips below, give you a feel for using a Secure by Design process:
  1. Secure coding – The application of secure coding techniques is a fundamental part of making a system secure. Flaws in code lead to vulnerabilities which lead to cybersecurity incidents. Make sure the product you develop or the one you buy in is built using secure coding practices. Check out OWASP’s secure coding practices checklist.
  2. Embed the right protection – Protective measures can be used across all layers of a system. There are a number of areas to consider, this gives you a flavour of some of them:
  Two-factor authentication (2FA): The use of a second factor to control access to a resource can help to mitigate malicious attacks such as phishing and non-malicious threats such as password sharing.
  Encryption: Data at rest and in transit should be protected using encryption. For example, database encryption and the use of secure transmission protocols, TLS/SSL.
  Correct configuration: Data breaches are also caused by misconfiguration of cloud storage. Making sure that your cloud infrastructure is hardened against cyber-attacks is an essential security practise.
  3. Keep it Simple Simon (KISS) – The first principle of security is KISS. Keep security as simple as possible; for example, only collect data you really need to collect, this reduces security overhead and help to meet the privacy principles of the General Data Protection Regulation (GDPR).
  4. Use the right protocols and implement them correctly – The tech industry has developed some excellent open standards that offer robust security when implemented correctly. For example, the standard protocol OAuth 2.0, has been developed using threat models and with security as a core consideration. Similarly, the JSON Web Token (JWT) has been designed to use digital signatures to maintain integrity during sessions. JWT can also help with resistance to Cross-Site Request Forgery (CSRF) attacks if implemented correctly.
  5. Use a security-enhanced interface – The human-computer touch-points can become a security gap if not properly designed. Good security starts with good usability, the balancing act needed for both is achievable with good design. It is often the simplest of UI ideas that can add the most security. For example, in the design of a credential recovery system, instead of revealing the existence of a live email account when account recovery is initiated, simply state that “If the account exists a reset link will be sent”. Similarly, don’t display your password policy on screen. If you let a cybercriminal know that your policy “must include a capital letter, a number, and a special character”, this will help them to create a more successful brute force attack. Instead, follow the advice from the United States National Institute for Standards and Technology (NIST) on the matter, this includes, do not use rules to force the creation of a password and do not have on-screen password hints.