[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 5 · 5.5.a
AP Cybersecurity · Securing Applications and Data
Secure by Design and Security by Default
Security in every phase of development — and enabled before the customer touches anything.
key ideaSecure by design puts security in every phase of development. Secure by default means the customer does not have to switch it on.
Matching controls to threats
Secure by design is an initiative encouraging companies to include security in all phases of product development, including design — rather than as a review before release. When it is implemented, security stops being a stage and becomes a property.
| Principle | What it asks of the company | What it changes for the customer |
|---|
| ownership of outcomes | build products that meet the security needs of customers | the customer is not left to compensate for the product |
| radical transparency and accountability | be open about vulnerabilities and how they are addressed | the customer can judge the risk rather than guess at it |
| leadership and structure | organize so security is a business priority | security decisions survive schedule pressure |
| secure by default | ship with security features enabled | protection without the customer configuring anything |
The fourth row is a concept within secure by design, not a fourth principle beside it. It is the part the customer actually experiences — devices and software secure out of the box.
Layering
Secure by designsecurity in all phases
Secure by defaultfeatures enabled on arrival
Boththe vendor carries the work
| Shipped state | Who bears the work | Typical outcome |
|---|
| insecure by default, secure if configured | the customer | most deployments stay at the default |
| secure by default, relaxable if needed | the vendor | most deployments are secure; the exceptions are deliberate |
| secure only in the paid tier | the customer’s budget | small organizations left exposed |
| documented vulnerabilities with fixes | shared | customers can assess and plan |
Row 1 and row 2 ship the same capability. The difference is only which state requires an action — and defaults are what almost every deployment actually runs.
Secure by designAn initiative to include security in all phases of product development, including design.
Secure by defaultSecurity features enabled by default, so devices and software are secure out of the box.
Ownership of outcomesBuilding products that meet the security needs of customers, rather than shipping and disclaiming.
Radical transparencyBeing open about vulnerabilities and how they are addressed.
what the initiative requires
- Security is included in all phases of product development, including design.
- Companies take ownership of customer security outcomes rather than shipping and disclaiming.
- Radical transparency and accountability about vulnerabilities is a principle, not a courtesy.
- Secure by default: security features should be enabled by default, so products are secure out of the box.
Worked analysis
EX 1
Two products, same features
Two routers support strong wireless encryption. One ships with it on; the other requires the buyer to enable it. Compare.
1
Note the capability is identical
Both can be configured securely.
2
Predict real deployments
Most buyers never change a default — so the second ships a population of insecure networks.
3
Name the principle
Secure by default — security features for software and devices should be enabled by default.
4
Note where the work moved
The first vendor took ownership of the customer’s security outcome; the second delegated it.
5
State the test
Ask what the product does for a customer who configures nothing. That is its real security posture.
EX 2
Transparency as a principle
A vendor discovers a serious vulnerability. One option is to fix it quietly. Assess against secure by design.
1
State the temptation
A quiet fix avoids reputational damage and awkward questions.
2
State the principle
Secure by design calls for radical transparency and accountability about vulnerabilities and how they are addressed.
3
State what silence costs the customer
They cannot assess their own exposure or prioritize the update.
4
Note the second-order effect
Customers who cannot see a vendor's record cannot choose between vendors on security at all.
5
Give the aligned response
Disclose the vulnerability and the fix, with enough detail for customers to act.
EX 3
Why leadership is a principle
Why does the initiative name organizational structure and leadership, rather than only engineering practices?
1
Note when security is dropped
Under schedule pressure, at the end of a project.
2
Ask who decides that
Not engineers — leadership, through what it prioritizes.
3
State the principle
Companies should have organizational structure and leadership that makes security a business priority.
4
Note what it enables
Security work in design, when it is cheap, rather than as a pre-release scramble.
5
State the reasoning
A practice that competes with the schedule loses unless someone senior has already decided it does not.
Check yourself
What is secure by design?
Show answer
An initiative encouraging companies to include security in all phases of product development, including design — rather than adding it before release.
Name the three design principles.
Show answer
Companies should take ownership of customer security outcomes; embrace radical transparency and accountability; and have organizational structure and leadership that makes security a business priority.
What is secure by default?
Show answer
A concept within secure by design: security features for software and devices should be enabled by default, so devices and software are secure out of the box.
Why does the default state matter so much?
Show answer
Because most deployments never change a default. A product that is secure only after configuration ships a population of insecure installations.