核心安全原则

Fixing bugs is not enough — you need a foundation. This lesson covers core security principles, the blueprints for building safe software from the start.

Security principles are mindsets, not tools: fundamental rules that guide secure design across any system or language and cut down vulnerabilities.

Least Privilege: give each user or process only the permissions it actually needs — nothing more. It limits the damage if an account is compromised.

In practice, least privilege means a reporting account has no admin rights, and a product-fetching service cannot modify customer records. Smaller surface, less risk.

Defense in Depth: layer multiple independent controls like a castle's walls and moats. If one fails, the next still stops the attacker.

Defense in depth combines layers: firewall, authentication, input validation, access control, and encryption — each covering what the others miss.

Secure by Design: bake security into every phase from planning onward. It is proactive, not patched on later — security as a core feature.

Build it in from day one with threat modeling, secure architecture, coding standards, and security reviews during design and code review.

These principles reinforce each other: Secure by Design guides you to apply Least Privilege and Defense in Depth, so a single failed control is never fatal.

Three foundations recap: Least Privilege (minimal access), Defense in Depth (layered controls), Secure by Design (security from the start). Next up: OWASP Top 10.