Security by Design

OWASP Security Design Principles

Apply these during design -- retrofitting security is 10-100x more expensive.

STRIDE Threat Modeling

Apply STRIDE to every component in a Data Flow Diagram (DFD). Four questions drive every session:

1. What are we working on? (system model)
2. What can go wrong? (threat identification)
3. What are we going to do about it? (mitigation)
4. Did we do a good enough job? (review)

STRIDE Reference

STRIDE per DFD Element

Risk Response Options

OWASP Top 10 -- Architectural Prevention

Focus on what the architect decides at design time, not implementation details.

A01: Broken Access Control (61% of breaches)

• Deny by default -- no endpoint open unless explicitly granted
• Centralized authorization service (OPA, Casbin, Cedar), not scattered checks
• Resource-level ownership -- queries scoped to authenticated user
• ABAC over simple RBAC for complex multi-tenant systems
• CORS with explicit origin allowlists -- never wildcards with credentials

A02/A05: Security Misconfiguration (rose to #2 in 2025)

• Infrastructure as Code with security scanning (tfsec, checkov) in CI/CD
• Hardened base images -- minimal containers with security baked in
• Configuration drift detection with automated alerting
• Environment parity -- same hardening across dev/staging/prod

A03: Injection (SQL #2 in CWE Top 25 2025)

• Parameterized queries everywhere -- reject PRs with string concatenation in SQL
• Treat ALL database-sourced data as potentially tainted (second-order injection)
• Allowlisting for dynamic query elements (table names, sort columns)
• Template sandboxing -- user input as DATA, never as template source

A04: Insecure Design (new in 2021)

• Mandate STRIDE analysis as gate for architecture reviews
• Abuse cases alongside every user story ("As an attacker, I want to...")
• State machines with explicit transitions for business logic
• Rate limiting built into architecture from day one

A06/Supply Chain (expanded in 2025)

• SCA scanning on every commit (Snyk, Dependabot)
• SBOM generation as build artifact
• Private package registry; block direct public pulls in production builds
• Lock files committed with integrity hash verification

A07: Authentication Failures

• Centralized IdP (Keycloak, Auth0, Cognito) -- no custom auth per service
• MFA required for sensitive data access and admin functions
• Progressive delays on failed attempts (exponential backoff, not permanent lockout)
• Session ID regeneration on every authentication state change

Secure Architecture Patterns

Zero Trust

Core: "Never trust, always verify" -- no implicit trust from network location.

Input Validation Pipeline

User Input
  -> Validation (allowlist, type, length, format)
    -> Business Logic (parameterized queries, ORM)
      -> Output Encoding (context-aware: HTML, JS, URL, CSS)
        -> Client

Key: input validation is complementary, not primary defense. Output encoding prevents XSS. Parameterized queries prevent SQLi. Validation adds defense in depth.

Secrets Management

Rules: never in source code | never in container images | rotate automatically | separate per environment | audit all access.

Required HTTP Security Headers

Security Testing in CI/CD

Strategy: SAST pre-commit (fast) -> SCA at build -> container scan -> DAST on staging -> block on critical/high findings.

API Security Checklist (OWASP API Top 10)

GraphQL-Specific

• Disable introspection in production
• Set maximum query depth (10 levels) and complexity limits
• Limit batch size; exclude sensitive operations from batching
• Field-level authorization in resolvers

Defensive Coding Patterns (Cross-Reference for Crafters)