Security by design is an engineering approach that builds protective measures into a system from the earliest planning stages rather than adding them after the product is already built. Security requirements are treated as first-class design goals alongside functionality, cost, and performance.
The reasoning is economic as much as technical. A flaw caught in a design review costs far less to fix than the same flaw discovered in production after a breach. In practice this means threat modeling during architecture, choosing safe defaults, applying least privilege, and reducing the attack surface before a line of code is finished. It pairs naturally with defense in depth and with privacy by design, its data-protection cousin now written into regulations like GDPR. The trap teams fall into is treating it as a slogan: bolting a penetration test onto the end of a waterfall project is not security by design, because the expensive architectural decisions were already locked in.
How is security by design tested on the CISSP?
It lives in Domain 3, Security Architecture and Engineering. Candidates should know secure design principles such as least privilege, defense in depth, fail-safe defaults, and economy of mechanism, and why early integration beats late remediation.