Secure Software Architecture and Design
Design is where threats are cheapest to remove
Secure design happens before code exists, where changes cost least. Know threat modeling as a repeatable process: decompose the system into data flows, processes, data stores, and external entities; draw trust boundaries; identify threats per element; rate them; choose mitigations that become requirements and tests.
STRIDE must be memorized: Spoofing (authentication), Tampering (integrity), Repudiation (non-repudiation and audit), Information disclosure (confidentiality), Denial of service (availability), Elevation of privilege (authorization). Attack trees decompose an attacker goal into steps; DREAD is a legacy rating scheme; PASTA is a risk-centric, attacker-minded methodology.
Apply architectural principles: least privilege, defense in depth, separation of duties, fail-safe defaults, complete mediation, economy of mechanism, open design, least common mechanism. Reduce attack surface - every port, API, and admin interface counts. Insert choke points and security zones, and validate at trust boundaries where privilege levels change. Design authentication, authorization (RBAC or ABAC), session management, cryptography (approved algorithms, key management lifecycle, never homegrown), logging, and error handling. In cloud, the shared responsibility model determines which controls are yours; microservices multiply network boundaries and demand service identity.
Traps
- STRIDE classifies threats; it does not rate or prioritize them.
- Encryption gives confidentiality, not authentication of the other endpoint.
- Threat modeling is iterative and belongs to design, not only to release.
Worked example
Credentials cross an unencrypted boundary from browser to login service. Spoofing calls for TLS with endpoint validation; Tampering calls for integrity checks - one boundary, two distinct threats.