Design Principles

Principle of Least Privilege

The principle states that a subject should be given only those privileges that it needs in order to complete its tasks.

If a specific action requires extra access rights, it can be augmented and the taken back when the action is performed.

Principle of Fail-Safe Defaults

The principle states that unless a subject is given explicit access to an object, it should be denied access to the object.

This principle requires that the default access should be none. If the subject is unable to complete its action, it should undo those changes it made in the security state of the system before it terminates.

Principle of Economy of Mechanism

The principle states that the security mechanisms should be as simple as possible.

If a design and implementation are simple, fewer possibilities exist for errors.

Example

EXAMPLE: The ident protocol [769] sends the user name associated with a process that has a TCP connection to a remote host. A mechanism on host A that allows access based on the results of an ident protocol result makes the assumption that the originating host is trustworthy. If host B decides to attack host A, it can connect and then send any identity it chooses in response to the ident request. This is an example of a mechanism making an incorrect assumption about the environment (specifically, that host B can be trusted).

Interfaces to other modules are suspects, making assumptions about input or output parameters.

Principle of Complete Mediation

The principle requires that all accesses to objects be checked to ensure that they are allowed.

Principle of Open Design

The principle states that the security of a mechanism should not depend on the secrecy of its design or implementation

A knowledgeable user can defeat the system by discovering secrets.

Principle of Separation of Privilege

The principle states that a system should not grant permission based on a single condition.

Example

EXAMPLE: On Berkeley-based versions of the UNIX operating system, users are not allowed to change from their accounts to the root account unless two conditions are met. The first condition is that the user knows the root password. The second condition is that the user is in the wheel group (the group with GID 0). Meeting either condition is not sufficient to acquire root access; meeting both conditions is required.

Principle of Least Common Mechanism

The principle states that mechanisms used to access resources should not be shared.

Sharing of internet with attackers can cause attacks to succeed. Instead the attackers should be able to access only part of internet, using proxy servers or traffic throttling.

Principle of Psychological Acceptability

The principle states that security mechanisms should not make the resource more difficult to access that if the security mechanisms were not present.

Principle	Key Concept	Memory Trigger
Least Privilege	Minimum rights for the task	"Need to know" basis.
Fail-Safe Defaults	Deny by default	No ID? No entry.
Economy of Mechanism	Keep it simple	Simple = Fewer bugs.
Complete Mediation	Check every access	No "I was just here" passes.
Open Design	No "Security by Obscurity"	Blueprints can be public.
Separation of Privilege	$1 + 1$ requirements	Two keys for one lock.
Least Common Mechanism	Don't share paths	Separate the "lanes."
Psychological Acceptability	Don't annoy the user	Make it usable.