The five modern design principles

Why eight was not enough

The 1975 eight were written for a mainframe with terminals. They aged unusually well, but they say nothing about virtualisation, nothing about replaceable components, and nothing about how a system should behave towards the person operating it. Five more principles — the additions used by the US National Centers of Academic Excellence in cyber defence — fill those gaps, and together with the original eight they make the thirteen fundamental security design principles an exam expects you to produce on demand.

The running system this time is Vantage Cloud, a hosting provider. One physical host runs a hypervisor; on top of it sit up to forty tenant virtual machines belonging to forty different customers who have never met and must never reach each other.

9. Isolation

Isolation is keeping things that should not interact from being able to interact, and it is examined in three distinct senses. Give more than one of them and you have shown you know it is not a single idea.

Isolate public-access systems from critical resources. Vantage's public marketing site and its customer sign-up form sit in a network segment with no route at all to the billing database. Physically, that can mean no connection; logically, it means layered services between the public face and the sensitive store, so a defect in the sign-up form cannot become a defect in billing.

Isolate users from one another. This is what an operating system or a hypervisor exists to provide: each tenant VM gets its own memory mappings, its own virtual disks and its own scheduler slice, so tenant A cannot read tenant B's memory even though the two are inches apart on the same silicon.

Isolate the security mechanisms themselves. The mechanisms that enforce everything else must be protected from tampering. Vantage keeps each host's disk-encryption key sealed in a hardware security module: the hypervisor may ask the module to unwrap a volume key, but no software path returns the master key itself, so an attacker who owns the host still does not own the key.

10. Encapsulation

Encapsulation is a specific form of isolation — the object-oriented one. Data and the procedures that operate on it live together in their own protected domain, the internals are reachable only by that subsystem's own procedures, and other parts of the system enter only through designated entry points.

Vantage's key-management service exposes exactly three operations: wrap, unwrap and rotate. There is no export. A caller cannot obtain key material — not because a check refuses, but because no interface exists that would return it. The internals are behind a wall with three doors in it.

This is the confusion the examiner is fishing for. Encapsulation is not a sibling of isolation; it is a kind of isolation, achieved through interface design rather than through separation of address spaces, machines or networks.

11. Modularity

Modularity has two senses and both are worth a sentence.

Security functions built as separate, protected modules. One hardened cryptographic module, reviewed once and used by every protocol that needs encryption, beats each protocol carrying its own re-implementation. The verification effort is spent once, and a fix lands once.

A modular architecture, so that a mechanism can be replaced without redesigning the system. At Vantage, TLS termination, token validation and audit logging are three separate services behind stable interfaces. When a padding flaw is announced against a cipher mode, one service is patched and redeployed inside an hour, and nothing else has to be re-tested. In the monolith it replaced, the same fix meant a full release.

Hold modularity apart from economy of mechanism by asking what the design reduced. Economy of mechanism reduces total size and complexity. Modularity reduces entanglement. A four-thousand-line monolith is neither; a four-thousand-line system in eight clean components is modular but not economical; a tiny single-file mechanism is economical but not modular.

12. Layering

Layering is the use of multiple, overlapping protections covering people, technology and operations, so that the failure of any one protection does not expose the system. The textbook treatment equates it with defence in depth, and the phrase is a fair summary: no single layer is trusted to be sufficient.

A Vantage host is protected at five layers, each with a control that would still be there if the layer above failed: the cage is locked and filmed (physical); the edge filter drops everything but two ports and each tenant sits in its own VLAN (network); the hypervisor is minimised and boots only signed images (host); the management API validates its input and authenticates every call (application); the volumes are encrypted with per-tenant keys (data). An intruder who talks their way into the cage still meets secure boot. One who defeats secure boot still meets encrypted volumes with keys they cannot extract.

The design question layering answers is not is this control strong enough but what happens when this control fails. If the answer is "everything", there is only one layer.

13. Least astonishment

A mechanism should respond in the way that least surprises the user, so that the user's intuitive mental model of what is protected matches what is actually protected. Authorisation should be transparent enough that people map their goals onto the mechanism without being told.

Deleting a VM in the Vantage console leaves its snapshots in place — and the confirmation dialog says so, in those words, before you click. An earlier version deleted the snapshots silently along with the VM, and a customer who believed snapshots were independent objects lost their only backup. Nothing about that release was insecure in the cryptographic sense. It was astonishing, and the astonishment destroyed data.

The pairing to keep straight: psychological acceptability is about a mechanism that obstructs the work, so people route around it. Least astonishment is about a mechanism whose behaviour surprises, so people form a wrong model of what is safe. A twelve-second airlock is unacceptable but not astonishing. A silent snapshot deletion is astonishing but not in the least obstructive. They fail differently and they are examined separately.