Secure by Default¶

Out-of-the-box configuration should be secure; security should not require explicit action or expertise to enable.

Tension Addressed¶

Convenience vs. Safety

Recognizable As¶

HTTPS by default; passwords required by default; permissions denied until granted; secure cookie flags default on; encrypted storage by default; authentication required for all endpoints unless explicitly public.

Canonical Sources¶

Saltzer & Schroeder, "The Protection of Information in Computer Systems" (1975)

Transfers To¶

Product design (safety features), API design (conservative defaults), configuration management (secure baselines), privacy by design

Most users never change defaults. If the default is insecure, most deployments will be insecure.