Core Security Principles
The design laws behind resilient defenses
Defense in depth, least privilege, fail-closed, secure by default and economy of mechanism are the design rules that make security survivable — not a collection of controls, but a way to reason.
What you will learn
- Apply least privilege and defense in depth to any system
- Compare fail-open and fail-closed behavior and their risks
- Evaluate designs against the core security principles
What is this?
Security principles are design laws derived from decades of failures. Defense in depth layers independent controls so one failure isn't game over. Least privilege grants only what a subject needs. Fail-closed defaults to deny when unsure. Secure by default ships a locked system. Economy of mechanism keeps things simple enough to verify. Applying them is what separates secure architecture from a checklist of tools.
Why do you need it?
- Belt-and-suspenders: any single control — firewall, WAF, IDS — will eventually fail; layering absorbs the breach.
- Least privilege shrinks the blast radius of a compromised account.
- Fail-open designs turn a monitoring outage into an authorization decision made by an attacker's laziness — fail-closed prefers a temporary outage over a compromise.
- 'It works' without these principles is usually 'it works for now, for the common path'.
Mental model
A castle: moat, walls, guards, armory
Defense in depth in a network
No single stone makes a castle safe. The moat slows approach, the wall stops most, the guards watch, and if the wall falls there's still the keep, and the treasury has its own lock — each layer assumes the previous one failed.
How it works
- Defense in depth: different classes of control (perimeter, host, app, data) each make an independent demand of an attacker.
- Least privilege: assign minimal permissions per role/task and review drift.
- Fail-closed/secure-by-default: if the policy engine can't decide, deny; if a service can't verify, refuse.
- Economy of mechanism: fewer moving parts means fewer attack surfaces and easier audit.
- Compartmentalization: split roles and zones so a compromise of one does not grant the whole kingdom.
Layered controls converging on a protected asset.
In production
- A multi-tenant API applies least privilege per customer row (row-level security) AND validates tokens per request (app layer) AND encrypts in transit (data layer).
- A CI pipeline fails-closed on an unknown dependency, blocking the build instead of shipping a supply-chain risk.
- A SOC role model grants 'response' rights to responders, not domain admin — a recovered credential stays recoverable.
Best practices
- Start from deny: write policies as allow-exceptions, not allow-everything-then-block.
- Layer controls from different domains (network + app + data) so they don't share the same failure.
- Review permissions and exceptions on a cadence; least privilege decays.
- Document why a control exists so a future engineer doesn't remove it 'to debug'.
Common mistakes
- Buying 'zero trust' branding while keeping all-any firewall rules — the layer exists only on paper.
- Making the auth service fail-open during an outage, then discovering the outage was exploited.
- Granting broad 'admin' because perms are tedious — one account becomes the crown jewel.
- Adding controls faster than the team can operate them; unmaintained controls are false strength.
Debugging tips
- When access breaks after a change, diff the before/after principals and roles — the principle that explains it is almost always least privilege.
- For 'why is this dropping traffic?', check whether the failure is intended fail-closed behavior or a misconfigured allow.
- Attack-surface reviews: count how many principals can reach a given asset. Fewer is correct.
Security considerations
- Least privilege and fail-closed can conflict with ops velocity; the answer is scoped break-glass paths, monitored and reversed, not permanently loose rules.
- Defense in depth is only true when layers are genuinely independent — two firewalls from one vendor with one root is often one firewall.
Interview checkpoint
Quick quiz
Which scenario illustrates fail-closed behavior?
Defense in depth works best when each layer can fail without the layers above noticing.