Theory: Secure Design Principles & Policy → Control → Standard
5.1 showed that one policy can be enforced by several different controls. So how do you choose between them, and how do you defend that choice to a manager, an auditor, or an exam marker? Picking a control is not enough; you must be able to say why. Secure design principles give you the vocabulary for that justification. This lesson covers the four principles used in this course and then shows how a chosen control becomes the seed of a formal Standard.
The Four Secure Design Principles
| Principle | One-line meaning | The question it asks |
|---|
| Defense in Depth | Layer multiple controls; don’t rely on any single one | “If this control fails, what still protects us?” |
| Least Privilege | Grant only the access a role strictly needs to do its job | “Does this person or system need this much access?” |
| Fail-Safe Defaults | When a decision is unclear, default to deny / off | “If nobody acts, or something goes wrong, what happens by default?” |
| Separation of Duties | Split sensitive tasks across more than one person | “Can one person complete this sensitive task alone?” |
Defense in Depth
Defense in Depth: protect an asset with several independent layers of controls, so that the failure of one layer does not expose the asset.
Every control fails sometimes: passwords are phished, doors are propped open, staff forget training. Layering means an attacker must defeat several different controls, and a failure in one is caught by another. Layers work best when they differ in function and nature (5.1): a preventive technical control plus a detective administrative control is stronger than two firewalls.
MediCare Plus example: patient records are protected by MFA at login (preventive), RBAC inside the EHR (preventive), audit logs of every record view (detective), and offline backups (corrective).
Least Privilege
Least Privilege: every user, role or system gets only the access it strictly needs to do its job, and nothing more.
Least privilege limits the damage when an account is misused or compromised: an attacker who steals a billing clerk’s password gets only what a billing clerk can see. It also limits honest mistakes.
MediCare Plus example: the Billing Staff role can view invoices only, not clinical notes. A nurse can update charts but cannot change the pharmacy’s medication master list.
Fail-Safe Defaults
Fail-Safe Defaults: when a decision is unclear, or when something fails or nobody acts, the system falls back to the safe state, which in security means deny / off / nothing happens.
The point is to stop security depending on someone remembering to do the right thing. Access is denied unless explicitly granted, rather than allowed unless explicitly blocked.
MediCare Plus example: a new employee’s account starts with no access until a role is approved; an unclaimed pull-print job is never printed.
Separation of Duties
Separation of Duties: split a sensitive task so that no single person can complete it alone. One person requests or performs; a different person approves or checks.
This protects against both fraud (one insider cannot act alone without collusion) and error (a second person catches mistakes).
MediCare Plus example: from the Week 4 access-control policy, Department Heads approve access requests and the IT Manager provisions them, so the IT Manager cannot grant themselves or a friend access without a department head’s approval. Similarly, the person who creates a refund in the billing system should not be the person who approves it.
Common mistake: Least Privilege vs. Separation of Duties.
Least Privilege is about how much access one person has. Separation of Duties is about splitting one task between several people. “The nurse cannot see billing data” is least privilege. “The nurse who prepares a high-risk drug dose needs a second nurse to verify it” is separation of duties.
Applying a Principle: Why Follow-Me Printing Is a Strong Choice
Return to the printed lab results risk. The control follow-me (pull) printing holds each print job in a queue and only releases it when the authorized user badges in at the printer. It is Preventive + Technical. Its justification uses three principles:
- Least Privilege: only the badge-holder who sent the job can release it, so nobody else can obtain that printout.
- Fail-Safe Defaults: an unclaimed job simply never prints. The safe outcome (“nothing happens”) is the default; it does not depend on anyone remembering.
- Defense in Depth: it pairs well with a supervisor’s audit walk-through (Detective, Administrative) as a second, different layer.
Use the Principle; Don’t Just Name It
A justification earns marks when it explains how the principle applies to this control, not when it merely names a principle.
| Weak justification | Strong justification |
|---|
| “Follow-me printing, because of least privilege.” | “Follow-me printing applies least privilege because only the clinician who sent the job, and who badges in, can release it, so no other passer-by can obtain the result.” |
| “Audit logs, for defense in depth.” | “The badge-release audit log adds a detective layer on top of the preventive printing control, so even if a printout is misused, we can still identify who released it.” |
A reliable sentence pattern for exam justifications: “[Control] applies [principle] because [what the control does] so that [the risk it removes].”
From Control to Standard
Once a control is chosen, it must be applied the same way everywhere. That is the job of a Standard, the second level of the Week 4 policy hierarchy.
| Policy | Control | Standard |
|---|
| Answers | What must happen? | How does it happen? | Exactly how, with what spec? |
| Form | General, mandatory rule; states intent, not detail | A real tool, process or physical measure | A precise, measurable, mandatory requirement |
| Example word | “must be protected” | “follow-me printing” | “60 seconds, badge-release” |
Worked example (MediCare Plus)
- Policy: “Printed lab results must not be left unattended on shared printers.”
- Control: Follow-me / pull printing: a job is held in a queue and released only when the authorized user badges in at the printer.
- Standard: “All clinical printers must use badge-release printing. The badge must be presented within 60 seconds of sending the job, or the job is automatically purged.”
Notice the shift: the standard states an exact, measurable spec (which printers, which mechanism, how many seconds, what happens otherwise). An auditor can check it.
Remember: a Policy without a Control is just words. A Control without a Standard can be applied inconsistently (one ward sets a 60-second purge, another sets none). All three work together: general intent, real safeguard, and exact spec.
The complete chain an organization follows:
Diagram loads as you scroll.
Worked Examples
Exercise 1
Name the secure design principle best illustrated by each MediCare Plus practice, and explain in one sentence.
- A newly created account has no system access until a department head approves a role.
- A pharmacist can dispense medication, but a doctor must create the prescription first.
- Patient records are protected by MFA, RBAC, audit logging and nightly offline backups.
- The help-desk technician can reset passwords but cannot read patient records.
Show solution ↓Hide solution ↑
Solution
- Fail-Safe Defaults: when nothing has been decided yet, the default is no access, so a forgotten approval leaves the account harmless rather than open.
- Separation of Duties: the sensitive task “get a drug to a patient” is split between the prescriber and the dispenser, so neither can do it alone.
- Defense in Depth: several independent layers (preventive, preventive, detective, corrective) protect the same asset, so one failure does not expose it.
- Least Privilege: the technician gets only what the job needs (account resets), not access to clinical data.
Exercise 2
A student justifies the control “automatic screen lock after 5 minutes idle on ward workstations” with the sentence: “Fail-safe defaults.” Rewrite this into a strong justification.
Show solution ↓Hide solution ↑
Solution
The weak answer only names the principle. A strong answer shows how this control applies it, using the pattern control → principle → what it does → risk removed:
“Automatic screen lock applies Fail-Safe Defaults because, if a nurse is called away and forgets to lock the workstation, the system falls back to the locked (safe) state on its own after 5 minutes, so an unattended session cannot be used by a passer-by to view patient records.”
Check: it names the control, names the principle, explains the mechanism (default to locked when nobody acts) and states the risk removed (unauthorized viewing). ✓
Exercise 3
At MediCare Plus, one person in the billing department can create a new supplier, enter the supplier’s bank account, and approve payments to it. Which principle is violated? Redesign the process.
Show solution ↓Hide solution ↑
Solution
Step 1: identify the risk. One person controls the whole sensitive chain. A dishonest employee could create a fake supplier with their own bank account and pay it, and nobody else would ever be involved.
Step 2: name the principle. This violates Separation of Duties: a sensitive task must be split so no single person can complete it alone.
Step 3: redesign.
- Billing Staff A creates the supplier and enters bank details.
- A different person (e.g. the finance manager) verifies and approves the new supplier and any bank-detail change, ideally confirming by phone with the supplier.
- Billing Staff B (not A) approves payments.
- The system enforces this: it will not let the same user both create and approve (a technical control).
Final answer: Separation of Duties is violated; split creation, verification and payment approval between different people, enforced by the billing system.
Exercise 4
MediCare Plus’s risk register lists “Shared login used by multiple nurses on ward workstations.” Write a matching Policy, Control, and Standard, and explain the difference between them.
Show solution ↓Hide solution ↑
Solution
- Policy (what must happen, general intent): “All clinical systems must ensure that access is individually attributable to a named user.”
- Control (how it happens, a real mechanism): individual EHR accounts with badge-tap login on ward workstations, so each nurse can log in quickly with their own identity instead of sharing one account. (Preventive, Technical.)
- Standard (exact, measurable spec): “Shared or generic login accounts are prohibited on any workstation with EHR access. All ward workstations must support badge-tap login and must auto-lock after 5 minutes idle.”
Difference: the policy states intent and changes rarely; the control is the safeguard that actually enforces it; the standard turns that control into a precise, checkable rule (no generic accounts, badge-tap, 5 minutes) so every ward implements it the same way.
Exercise 5
Label each statement as a Policy, a Control, or a Standard.
- “All hospital laptops must use full-disk encryption and lock after 5 minutes of inactivity.”
- Full-disk encryption software installed on each laptop.
- “MediCare Plus shall protect patient information stored on portable devices.”
Show solution ↓Hide solution ↑
Solution
Ask: is it a general intent (policy), a real safeguard (control), or a precise measurable rule (standard)?
- Standard: mandatory and measurable (“full-disk encryption”, “5 minutes”); an auditor can check every laptop against it.
- Control: the actual tool that enforces the requirement.
- Policy: a broad statement of management intent with no specifics.
Final answer: 1 = Standard, 2 = Control, 3 = Policy.