Secure by design means choosing the most secure way to complete each engineering task while maintaining a reasonable cost, benefit, and risk trade-off. section 12.1.1
For a web API approaching release, security decisions shape the production architecture before publishing begins, rather than appearing only after deployment. section 12.5
Apply the approach by:
- Reviewing configuration files and removing unnecessary or potentially vulnerable middleware. section 12.5
- Adding countermeasures such as HTTP security headers to reduce exposure to attacks, DDoS attempts, and data breaches. section 12.5
- Using a CDN and full encryption between the hosting server and users’ browsers when the architecture supports it. section 12.5
- Checking network exposure before creating a cloud VM, especially ports needed by RDP and Web Deploy. section 12.5
