Summary
This chapter covered security design principles and controls, and the importance of not only installing security controls but also testing them for effectiveness. Security professionals need to apply security design principles that include threat modeling, least privilege, defense in depth, secure defaults, failing securely, SoD, keeping things simple, Zero Trust, privacy by design, trust but verify, and shared responsibility.
Multiple systems are used to secure and access data, including Bell-LaPadula, which focuses on confidentiality, and Biba, which focuses on integrity. Clark-Wilson deploys most features of Biba and prevents tampering. A system of ethical walls, which helps to prevent conflicts of interest, constitutes the Brewer and Nash security model.
Security professionals must remember that one of the most important security principles is a layered defense model, and then scope and tailor controls as needed depending on the framework used for their organization...
