Open cardosec

Case 99070A · GRC · L1 Foundations

Secure Design Principles

Practise as: Explain it · InterviewLevel: L1 Foundations

Interview questionWhich secure design principles do you rely on most, and can you give an example of each?

  1. 01 What is it?
  2. 02 How is it abused?
  3. 03 How do you stop it?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Saltzer and Schroeder (1975) set out the classics: least privilege, fail-safe defaults, complete mediation, economy of mechanism.
  2. Least privilege: grant only what a task needs, for as long as it needs it, such as just-in-time admin access.
  3. Fail-safe defaults and complete mediation: deny unless allowed, and check authorization on every request, not just the first.
  4. Defense in depth and separation of duties: no single control or person should be enough for an attacker to win.

If the interviewer pushes back

  • Pick a system you know. Which principle does it violate most, and what would fixing it cost?

Go deeper

More GRC cards

All GRC cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09