Core Security Principles

Fixing bugs is not enough — you need a foundation. This lesson covers core security principles, the blueprints for building safe software from the start.

Security principles are mindsets, not tools: fundamental rules that guide secure design across any system or language and cut down vulnerabilities.

Least Privilege: give each user or process only the permissions it actually needs — nothing more. It limits the damage if an account is compromised.

In practice, least privilege means a reporting account has no admin rights, and a product-fetching service cannot modify customer records. Smaller surface, less risk.

Defense in Depth: layer multiple independent controls like a castle's walls and moats. If one fails, the next still stops the attacker.

Defense in depth combines layers: firewall, authentication, input validation, access control, and encryption — each covering what the others miss.

Secure by Design: bake security into every phase from planning onward. It is proactive, not patched on later — security as a core feature.

Build it in from day one with threat modeling, secure architecture, coding standards, and security reviews during design and code review.

These principles reinforce each other: Secure by Design guides you to apply Least Privilege and Defense in Depth, so a single failed control is never fatal.

You are designing a new payment processing system. Which security principle would guide you to ensure that the microservice responsible for generating invoices can only read customer data, and not modify their account balance?

Three foundations recap: Least Privilege (minimal access), Defense in Depth (layered controls), Secure by Design (security from the start). Next up: OWASP Top 10.