Fail Securely¶

When systems fail - and they will - the failure mode should default to a secure state rather than an open/permissive one.

Tension Addressed¶

Security vs. Usability

Recognizable As¶

Deny by default; exception handlers that revoke access; circuit breakers that block rather than bypass; default-deny firewall rules; authentication failures that don't reveal whether username or password was wrong.

Canonical Sources¶

Saltzer & Schroeder, "The Protection of Information in Computer Systems" (1975)

Transfers To¶

Safety engineering (fail-safe defaults), circuit design (fail-open vs. fail-closed), API design (error handling), mechanical systems (dead man's switches)

The opposite - fail open - is seductive because it maintains availability, but it means every error becomes a potential bypass.