Security by Design
Security by design is the principle of engineering security into a product from the very first concept phase, instead of retrofitting it afterwards through patches. Standards such as ISO/SAE 21434 and laws such as the EU Cyber Resilience Act make the principle binding.
What does security by design mean in concrete terms?
Security by design is not a single tool, but a way of working along the entire development process:
- Analyze threats early: systematically think through, as early as the concept phase, what is worth protecting and how an attacker could compromise it — with methods such as threat modeling or a TARA.
- Derive architecture from risks: security requirements and design decisions follow from the risk analysis, not from gut feeling or checklists.
- Verify instead of hope: the implementation of the security requirements is demonstrated through reviews and tests.
- Maintain across the lifecycle: new vulnerabilities and threats flow back into the analysis — security by design does not end with the release.
Distinction: design instead of patching afterwards
The counter-model to security by design is the reactive approach: build first, then react to discovered vulnerabilities with patches. Patches remain necessary even with the best preparation — but as the sole strategy they fall short:
| Security by design | Patching afterwards | |
|---|---|---|
| Timing | Concept and design phase | After implementation or release |
| Reach | Can prevent architectural flaws | Fixes individual symptoms — architectural flaws can hardly be patched away |
| Cost | Upfront investment in analysis and design | Every late correction costs a multiple; those who only think about attack paths after implementation pay for every design decision twice |
| Attitude | Proactive, risk-based | Reactive, incident-driven |
Security by design in the Cyber Resilience Act
The EU Cyber Resilience Act (CRA) makes security by design a legal obligation for products with digital elements placed on the EU market. It entered into force on 10 December 2024; from 11 September 2026, reporting obligations apply for actively exploited vulnerabilities and severe security incidents, and from 11 December 2027 all requirements must be fulfilled. In addition to security by design, the CRA requires security by default — a secure basic configuration in the delivery state — and lifecycle responsibility: vulnerability management, update management and reporting obligations across the entire support period.
Security by design in standards
The major cybersecurity standards also embody the principle: ISO/SAE 21434 anchors the TARA as early as the concept phase of the vehicle lifecycle, and IEC 62443 requires a secure product development lifecycle for industrial components. Both work risk-based — every measure is derived from a structured threat analysis, not glued on afterwards.
Security by design in practice
Security by design is not a slogan, but simply the more economical way of working: a design decision made in the concept phase costs a fraction of its later correction. Getting started is unspectacular — a clean threat analysis at the beginning of the project, documented risk decisions and the discipline to update this analysis with every system change. In practice, the hard part is not the first draft, but the maintenance across years and product variants — that is exactly where it is decided whether security by design is lived or remains paper.