Cyberattack attempts were at an all-time high towards the end of 2021 and all signs indicate that malicious actors will keep that momentum going into 2022. What does this mean for the average business owner? Well, considering that small businesses are attacked more than anyone else, we’d say it’s time to take another look at your cybersecurity measures, especially in your internet-connected assets — the biggest of which is your business software.

The problem is, most small businesses, startups, and even enterprises to some degree, cannot always divide resources equally between software development and cybersecurity. But do you even need to? Modern application design is changing and there’s a way that companies with limited resources can leverage cybersecurity principles to make security a part of their design.

Security-by-Design: Changing the Perspective on Cybersecurity

Security-by-design is an approach to software development that aims to minimize system vulnerabilities and reduce the chances of cyberattacks by incorporating security specifications in the design and evaluating security at each stage of designing your app.

Like other software development methodologies, security by design begins with a change in mindset. When making design choices, developers are encouraged to use design patterns that positively impact the security of the app. For instance, automating testing with DevOps using CI/CD pipelines is a great example of a workflow that not only improves the software development in general but specifically impacts security in a positive way.

Other examples include using a loosely-coupled architecture such as one based on microservices to avoid total system failure and fault isolation, or creating a secure environment within the cloud. Frankly, the possibilities are virtually limitless.

What’s equally important is understanding the benefits of this approach. Opting for security-by-design will enable you to:

• Early detection and response to security vulnerabilities and misconfigurations
• Documentation of security measures throughout SDLC makes it easier to understand failures
• Reduce the cost of a separate security program
• Easier and timely decision-making thanks to comprehensive risk management

Applying Cybersecurity Principles to the SDLC

The good news for developers is that there are established frameworks and guidelines to help you integrate proper cybersecurity principles into the SDLC as the foundation for secure application design.

1. Minimize attack surface area

The attack surface refers to all of the assets within your website that can act as a potential entry point for attackers, including webpages, network protocols, and even active listening ports. Naturally, the attack surface will grow over time but as the developer, your goal should be to always minimize it. It’s important to understand that adding functionality does not directly increase the attack surface — adding ways through which a system can be compromised does.

Here is how the attack surface can be kept to a minimum throughout the SDLC:

• Reduce user roles number to the minimum
• Avoid storing confidential data whenever you can
• Disable features that you don’t need or use at all times
• Introduce intrusion detection and prevention systems (e.g., Web Application Firewall)
• Remove unwanted ports and services from your product
• Remove debug ports, headers, and traces from circuit boards

2. Secure by default

Many users prefer pre-configured systems, which, although convenient, can be headache-inducing, especially if the configuration is not optimized correctly. Having a secure by default product or system is crucial. When a product is secure by default, its default settings for the system are secure and usable with the needed security mechanisms up and running. Having such a secure default system will ensure that its users can use it safely without changing anything. To make a system secure by default, you can:

• Implement a prompt after the first logging attempt
• Disable all insecure services
• Set HTTPS-only by default

3. Least privilege

The concept of least privilege recommends that the services, processes, and users within any system have only the privilege required to perform their operations on their own (e.g., user rights, resource permissions). In other words, every process should be able to execute with the least privileges needed for it. Mechanisms for controlling the resources should also not be shared.

4. Defense-in-depth

The principle of defense in depth or layered defense is a cybersecurity principle that encourages having multiple levels of security. There are numerous ways of doing this but common layers include:

• Secure communications and regular security updates
• Secure configurations by restricting unwanted and insecure services
• Implement Firewalls, IDS/IPS, sandboxing, monitoring, etc.
• Limit access control
• Implement ID card requirements, fences, CCTV., etc.
• Create a solid policy for risk management, incident response, training, and so on

5. Fail securely

If a system or app should fail at some point, it should do so securely. In other words, developers should plan how a component will fail and ensure it does not impact the security of the overall app. System failure must not allow:

• Access to sensitive user information
• Access to keys and passwords
• Attackers to install unauthorized software
• Attackers to use the product to launch more attacks on the network

A failure should never provide additional user privileges and permit the user to bypass access controls.

6. Promote privacy

Nowadays, private consumer information is being collected and processed all the time which makes cybersecurity even more important. You should never allow your product or system to compromise the user’s privacy, and you need to take privacy as a critical issue during the design. All customer data processed by your product needs to be defined, including audio and video recordings, PII, SPII data, etc. The table below outlines solutions for both IoT apps (e.g., cloud-connected PLCs) and embedded products (e.g., intelligent electronic devices):

Embedded Products

• End-to-end communication encryption
• Secure inter-cloud communications
• Encrypted databases
• Operation measures like a request portal for secure data deletion
• Virtual machines (VMs) or encrypted disks

IoT Apps

• Encrypted disks
• Encrypted databases
• Encrypted communications with tamper-proof hardware and end-user documentation

7. Zero-trust security

Zero-trust or trust no-one approach creates a security system where no user or product is trusted by default from either inside or outside of it your network. You can achieve this by implementing authentication and authorization requirements for anything and anyone who wants to have access to resources on your network. The ‘zero-trust’ principle can be implemented by setting up two-factor and multi-factor authentication systems for your cloud apps or implementing a multi-factor authentication VPN for local network connections.

Security and Design Go Hand in Hand

Times are changing and in 2022, security and development are no longer isolated functions. Their responsibilities intertwine and today no technology strategy can take place without discussing security. With companies having significant resources and investments in the digital form, it’s important that everyone understands that security and design go hand in hand, from the top C-level executives to the new hires.

The goal is no longer to rely on trusted equipment as the backbone of safe networks but to leverage the security-by-design approach to build a holistic program that protects your digital interests. That said, there are still a lot of myths and misconceptions, especially regarding the cost and manpower required during cybersecurity programs. The goal of this article was to dispel those myths and show that there are entire frameworks in place to ensure application security.

That said. if you have questions on how these cybersecurity principles can be applied to your application or company specifically, reach out to our AppSec experts here at Moonlight Labs for a free consultation today.

‍