Secure by design
Secure by design is an engineering approach that incorporates security requirements and protections throughout a system’s design, development, and lifecycle.
Secure APIs
API security by design is an API security approach that incorporates security concerns from API design through the entire development cycle.
- How it is used
- Positions security as a continuous API development concern spanning design, implementation, testing, deployment, and operations.
- How deep it goes
- Explains shift-left rationale, lifecycle practices, design flaws, implementation patterns, testing, and infrastructure, but defers detailed vulnerability categories.
- Examples
- Uses bounded pagination, payment request models, sensitive response data, unsafe user flows, and infrastructure controls as concrete security cases.
- What you can do after
- Apply it to design, implement, test, deploy, and monitor APIs with fewer late security surprises.
Data-Driven Cybersecurity
An engineering approach that incorporates security considerations and controls throughout the design and development life cycle.
- How it is used
- Embeds security collaboration and controls within product development rather than relying solely on hierarchical policy enforcement.
- How deep it goes
- Explains the organizational model and software development life cycle integration, but stops short of specifying individual controls or implementation steps.
- Examples
- Uses technology companies, agile development cycles, and collaboration between security, product, and engineering leads.
- What you can do after
- Apply it via cross-functional collaboration that embeds security controls within software development life cycles.
Read how Data-Driven Cybersecurity explains secure by design →
Building Web APIs with ASP.NET Core
Security by design is an engineering approach that incorporates security considerations into system design and implementation from the beginning.
- How it is used
- Guides release and deployment decisions for a web API before publishing it to production.
- How deep it goes
- Explains a decision principle and several deployment checks, but stops short of detailed implementation procedures.
- Examples
- Uses configuration review, middleware removal, HTTP security headers, CDN encryption, and cloud VM port checks as practical examples.
- What you can do after
- Operate/configure a web API release by reducing unnecessary exposure and selecting more secure hosting and edge protections.
Read how Building Web APIs with ASP.NET Core explains secure by design →
Related concepts
- shift leftequivalent to · Shift left is the practice of performing testing, security, operations, compliance, or other quality activities earlier in the software development lifecycle.
- property enumerationaddresses · Property enumeration is an exploit that reveals fields of an application's data models that are not intended for external users.
- API securitykind of · API security is the protection of application programming interfaces, their functionality, and exposed data from unauthorized access, misuse, alteration, and disruption.
- api-first architectureused by · An approach that treats APIs as primary product interfaces by specifying their contracts as a foundation for implementing the services and clients that use them.
- software development life cycleimplements · The software development life cycle is the organized set of activities through which software is planned, specified, designed, built, tested, delivered, operated, and maintained.
- API documentationuses · API documentation is written or generated material describing an application programming interface’s capabilities, operations, inputs, outputs, behavior, and usage.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.