Security 1st Design Principle 

"Security by Design"
&

 "Security by Default"

+

"Privacy by Design"

Security by Design is...

Customers should not have to choose between
security and usability

If security is something special for people to get or do, 
then most will not get or do it 

Bad security design is expensive

• Incremental security measures become more costly and less secure
• 6.5x more expensive to find and fix an application flaw in development than during design
• 15x more expensive during testing
• 100x more expensive during production

National Institute of Standards and Technology (NIST)

 Why?

• Requires coordination of multiple activities and environments (i.e., PROD vs. UAT)
• Finding the vulnerable code
• Fixing the vulnerable code
• Testing of the feasibility of the fix
• Testing the setup of the fix
• Creating and testing international/localized versions
• Posting of the fix
• Retesting the fix and dependent systems
• Writing support documentation related to the fix
• Handling negative public perception
• Bandwidth and download expenses
• Lost productivity
• Customer implementation efforts
• Potential loss or postponement of market opportunities 

Relative cost to repair defects

https://www.nist.gov/sites/default/files/documents/director/planning/report02-3.pdf

IBM Systems Sciences Institute

Let us help you design an effective cybersecurity strategy