National Cyber Security Centre

The Australian National University

Home Informationfor...Advice &guidanceEducation& skillsProducts&servicesNews,blogs,events...HomeMenuGUIDANCESecure design principlesGuides for the design of cyber secure systemsPUBLISHED21 May 2019REVIEWED21 May 2019VERSION1.0WRITTEN FORSmall & medium sized organisationsPublic sectorCyber security professionalsLarge organisationsWas this article helpful?Yes NoPAGESPagesSecure design principlesCyber security design principlesVirtualisation security design principlesExamplesSecurity architecture anti-patternsPAGE 1 OF 17Getting the most from the secure designprinciplesThese principles are intended to help ensure that thenetworks and technologies which underpin modern life aredesigned and built securely.The problemTo be useful, systems very often need to move, store andprovide access to sensitive data. Unfortunately, this makesthem prime targets for cyber attack. If these systems aresuccessfully compromised, the fallout can be damaging,expensive and embarrassing.However, the picture need not be a bleak one. Frequently, thevery worst outcomes can be avoided if services aredesigned and operated with security as a coreconsideration.With this in mind we have developed a set of principles toguide you in the creation of systems which are resilient toattack, but also easier to manage and update.System designThroughout this guidance, we use the term system, by whichwe mean 'a collection of digital components that areconnected using communication technologies to perform abusiness function.' A good example of the sort of system weare describing here is the UK's online passport applicationservice, but it could refer to many other digitally-enabledbusiness functions.We will also use the term cyber-physical system, by whichwe mean 'a system that measures or controls the physicalworld to achieve a particular goal.' A good example is amodern car, in which complex logic measures the physicalenvironment in order to control the movement of thevehicle.The principles have been conceived to be applicable to bothdigital systems and cyber-physical systems.AudienceThis guidance is aimed at people who design systems. Theprinciples are most useful in the design and build phases ofa project, although they can also be used to review existingsystems.How this guidance is structuredApplying the principles will require some customisation tosuit your particular situation. For example, the exactrequirements of an online information service will bedifferent to the remote management of a power station.However, the principles will guide your considerations ineither case.The Cyber Security Principles offer the most generallyapplicable advice. The Virtualisation Design Principles applyto the more specific case of systems which rely onvirtualisation technologies.We have divided each set of principles intofive categories, loosely aligned with stages at which anattack can be mitigated:Establish the context Determine all the elements which compose yoursystem, so your defensive measures will have no blindspots.Making compromise difficult An attacker can only target the parts of a system theycan reach. Make your system as difficult to penetrate aspossibleMaking disruption difficult Design a system that is resilient to denial of serviceattacks and usage spikesMaking compromise detection easier Design your system so you can spot suspicious activityas it happens and take necessary actionReducing the impact of compromise If an attacker succeeds in gaining a foothold, they willthen move to exploit your system. Make this as difficultas possibleTopicsCritical National Infrastructure (CNI)Security architectureCyber securitydesign principlesPUBLISHED21 May 2019REVIEWED21 May 2019VERSION1.0WRITTEN FORSmall & medium sizedorganisationsPublic sectorCyber security professionalsLarge organisationsWas this article helpful?Yes NoAlso seeNew SOC guidance 101Explaining the rationale behind theNCSC's updated Security…Blog Post23 May 2022Building a Security OperationsCentre (SOC)Guidance to help organisationsdesign a SOC and security…GuidanceThe Technology AssuranceprinciplesCovering the ‘Productdevelopment', 'Design and…Blog Post11 May 2022

Secure design principles: guides for the design of cyber secure systems (2019)

https://openresearch-repository.anu.edu.au/bitstream/1885/277655/1/UKCyber_6.pdf

Secure design principles: guides for the design of cyber secure systems (2019)

Abstract

Similar works

Full text

Available Versions

The Australian National University