Skip to content

Chapter 6 of 6

Security Principles and Defensive Design

Beyond any single technology, robust software security rests on a small number of enduring design principles. The principle of least privilege holds that every user, program, and process should operate with only the minimum permissions necessary to perform its function. Applied at the database tier, this means a web application's DB account should be able to run only the queries it needs, not arbitrary administrative operations. Applied at the infrastructure tier, container processes should run as non-root users, IAM roles should grant only the AWS actions required, and API tokens should be narrowly scoped. The benefit is containment: when something goes wrong, least privilege dramatically shrinks the blast radius of the breach.

Defense in depth is the companion idea: no single control is ever considered sufficient, and security is built up from many overlapping layers. Network-level protections such as firewalls, virtual private networks, and intrusion detection systems shield the perimeter; application-level controls like input validation and authentication protect the user-facing surface; data-level measures including encryption at rest and strict access controls protect information even if attackers reach the database; physical safeguards keep servers locked away; and continuous monitoring through logging and alerting ensures that anomalies are detected quickly. Man-in-the-middle attacks illustrate the model well: HTTPS/TLS encrypts traffic, HSTS prevents downgrade attempts, certificate pinning and chain validation reject rogue certificates, and secure Wi-Fi like WPA3 protects the underlying link. Layering means an attacker must defeat every control, not just one.

Finally, the everyday disciplines of input validation and output encoding deserve emphasis because they are the front line against injection attacks. Input validation verifies that user-supplied data matches expected format, type, length, and range before processing. The allowlist approach, accepting only known-good patterns, is far stronger than the denylist approach of trying to reject known-bad input, and validation must run on the server even when it also runs on the client for user experience. Output encoding is the other half: it transforms data for safe display in a specific context, whether HTML encoding for web pages, URL encoding for links, or JavaScript encoding for script bodies. The two work together: validation keeps bad data out in the first place, and encoding protects the system when some bad data slips through or was already present in storage. Combined with rate limiting, secrets management, secure session handling, and the broader defensive mindset, these principles turn security from a checklist of features into a continuous practice woven throughout the software development lifecycle.

All chapters
  1. 1The OWASP Top 10 and Web Application Threats
  2. 2Cryptography: Securing Data in Transit and at Rest
  3. 3Authentication, Authorization, and Identity Protocols
  4. 4Browser Security Mechanisms and HTTP Headers
  5. 5Session Management, Secrets, and Rate Limiting
  6. 6Security Principles and Defensive Design

Drill it

Reading is not remembering. These come from the Software Security deck:

Q

What is the OWASP Top 10?

The OWASP Top 10 is a regularly updated list of the most critical web application security risks. The 2021 edition includes: A01: Broken Access ControlA02: Cryp...

Q

What is Cross-Site Scripting (XSS)?

XSS is a vulnerability where an attacker injects malicious scripts into web pages viewed by other users. Three types: Reflected: script in URL is reflected back...

Q

What is reflected XSS?

Reflected XSS occurs when user input from a request is immediately included in the response without proper encoding. Example: a search page that displays the qu...

Q

What is stored XSS?

Stored XSS (persistent XSS) occurs when malicious script is saved on the server (e.g., in a database, forum post, or comment) and served to users who view that...