Security Design Principles
Lecture 3-4
Instructor: Dr. Humaira Arshad
This chapter covers the fundamental security design principles of Least Privilege and
Defense in Depth. These principles guide the secure design and administration of systems
by reducing risk, limiting exposure, and building resilience. Students will explore these
principles through real-world examples, analogies, and diagrams.
1. INTRODUCTION
When engineers or administrators design an information system, the choices they make
strongly influence their security. Just as an architect builds a house with locks, fire escapes,
and reinforced doors, a system designer must follow certain security design principles.
These principles reduce risk, improve resilience, and preserve confidentiality, integrity, and
availability.
2. PRINCIPLE OF LEAST PRIVILEGE
The Principle of Least Privilege (PoLP) states that any user, program, or system process
should operate with the minimum level of access rights necessary to perform its functions.
By restricting privileges, the scope of damage from accidental or malicious misuse is
reduced.
2.1 REAL-LIFE ANALOGY
Imagine giving a house key to a cleaning worker. To do their job, they only need access to
the living room and kitchen, not the master bedroom or safe. Similarly, granting users full
administrator rights when they only need limited access increases unnecessary risk.
2.2 APPLICATIONS IN COMPUTING
Examples include:
• Normal employees using standard accounts instead of administrator accounts.
• Students having read-only access to exam results, not modification rights.
• Web servers running under restricted service accounts rather than as system
administrators.
Figure 1. Conceptual diagram of Least Privilege
2.3 BENEFITS
Least Privilege reduces the attack surface, contains damage if an account is compromised,
and encourages accountability by linking actions to specific users.
3. DEFENSE IN DEPTH
3.1 DEFINITION
Defense in Depth (DiD) is a layered security strategy where multiple protective measures
are applied at different levels of a system. The approach ensures that if one layer fails,
others continue to provide protection. The concept resembles a fortress with outer walls,
inner gates, guards, and a central keep.
3.2 LAYERS OF DEFENSE IN COMPUTING
Defense in Depth in information systems is typically organized into multiple layers, each
addressing risks at a specific domain:
1. Physical Security — locks, cameras, biometric controls.
2. Network Security — firewalls, IDS/IPS.
3. Host Security — antivirus, patches.
4. Application Security — secure coding, input validation.
5. Data Security — encryption, backups, access control.
6. Human/Policy Layer — training, acceptable use policies.
Each of these layers strengthens overall security. Even if one barrier fails, the others
provide additional safeguards. This layered approach also creates multiple opportunities to
detect and respond to threats. By conceptualizing security as a chain of interdependent
protections, organizations can achieve resilience even under persistent attack.
Figure 2. Defense in Depth Layers
3.3 REAL-LIFE EXAMPLE
An online banking platform uses multiple layers of defense: firewalls block malicious traffic,
IDS detects unusual activity, servers are patched, applications use HTTPS encryption, role-
based access ensures users only see what they need, and backups ensure recovery.
Together, these defenses ensure resilience even if one control fails.
This example highlights the layered strategy in practice. Attackers may bypass a firewall,
but intrusion detection or application-level validation still limit their success. In this way,
defense in depth slows intrusions and improves chances for detection and response.
Figure 3. Defense in Depth applied to online banking (to be added).
3.4 BENEFITS
Defense in Depth enhances resilience by ensuring that no single failure compromises the
system. It increases detection opportunities and provides flexibility to add new layers as
threats evolve. The strategy ensures that attackers face multiple barriers, buying time for
defenders to respond.
From an academic perspective, this layered model acknowledges the inevitability of system
flaws. Rather than striving for unrealistic perfection at one level, security engineers spread
risk and responsibility across layers, which makes the overall system more adaptive and
sustainable against evolving threats.
Figure 4. Benefits of Defense in Depth (to be added).
4. INTEGRATION OF PRINCIPLES
Least Privilege and Defense in Depth complement each other. Least Privilege restricts what
users and processes can do, while Defense in Depth ensures that multiple overlapping
safeguards protect against failure. In a university network, for example, students have
restricted accounts (least privilege), while the system as a whole is protected by multiple
layers such as firewalls, antivirus, and backups (defense in depth).
5. SUMMARY
• Least Privilege: Give users and processes only the access they need.
• Defense in Depth: Apply layered defenses so no single failure compromises the system.
Together, these principles form the foundation of secure system design.
6. PRACTICE QUESTIONS
1. Give three examples of least privilege in daily computing.
2. Explain how defense in depth could protect a hospital’s digital records.
3. Compare and contrast least privilege and defense in depth.
4. Why is it dangerous to give administrator rights to all employees?