What is Security by Design?
Security by Design is a design principle in which security is a fixed requirement from the very first design step for systems, software, networks and devices, rather than a measure added after delivery or after an incident. Security thus becomes part of the architecture, the development process and every technical choice, from specification through maintenance to decommissioning. In OT environments this matters even more, because a PLC or DCS often stays in service for 15 to 20 years and weaknesses designed into it are hard to fix later.
🧠 Where does Security by Design come from?
The idea is older than the term. In 1975 Jerome Saltzer and Michael Schroeder published eight design principles for secure systems that still form the foundation today:
| Principle | Meaning | Example in OT |
|---|---|---|
| Economy of mechanism | Keep the design as simple as possible | Only the services a controller actually needs |
| Fail-safe defaults | Access is denied by default unless explicitly permitted | Firewall rules on a conduit following default deny |
| Complete mediation | Check every access, not just the first | Every write command to a PLC is authorised |
| Open design | Security must not depend on the design being secret | No reliance on an obscure proprietary protocol |
| Separation of privilege | Critical actions require more than one condition | MFA plus approval for a logic change |
| Least privilege | Grant only the rights that are needed | Operators may operate, not program |
| Least common mechanism | Share as few mechanisms between users as possible | No shared accounts on engineering workstations |
| Psychological acceptability | Security must remain usable | Log-in that works with gloves on and under time pressure |
Microsoft made a Security Development Lifecycle (SDL) mandatory for its products from 2004, and in 2022 NIST bundled secure development practices into the Secure Software Development Framework (SP 800-218). In April 2023 the US agency CISA and international partners launched the Secure by Design guidance, revised in October 2023. It asks manufacturers to take ownership of their customers’ security outcomes, embrace radical transparency and accountability, and lead security from the top.
🔄 What is the difference between Security by Design and Secure by Default?
The two terms are often used interchangeably, but they are not the same:
| Aspect | Security by Design | Secure by Default | Security as an add-on |
|---|---|---|---|
| When | During design and development | At delivery and first commissioning | After delivery or after an incident |
| Who | Manufacturer and designer | Manufacturer | User or administrator |
| Goal | Prevent vulnerabilities at the core | Secure starting point without extra effort | Close existing gaps |
| Example | Threat model, secure boot, signed firmware | No default password, Telnet off, logging on | Separate firewall in front of an unprotected controller |
| Result | Fewer vulnerabilities and lower operating burden | Fewer misconfigurations | Gaps, inconsistent implementation, higher cost |
Secure by Default is therefore an outcome of Security by Design: a product can only be shipped securely if it was designed that way. The same way of thinking exists for personal data as Privacy by Design.
🎯 Why is Security by Design important for OT?
- Long service life - installations run for decades, whereas an add-on measure has to be refitted every few years
- Patching is difficult - patching needs a downtime window, so every vulnerability prevented in the design saves years of exposure
- Attackers target products - according to CISA and its partners, attackers pick specific OT products with weak authentication, default passwords and limited logging, so a single weakness hits many victims
- Safety and security meet - a manipulated control system can cause physical harm, as TRITON showed with a safety instrumented system
- Legal obligation - the Cyber Resilience Act and the Machinery Regulation make secure design mandatory for new products, and NIS2 requires organisations to address security when acquiring and developing systems
The same applies to industrial IoT devices, which are often rolled out in large numbers and are hard to manage centrally: what is not in the design can rarely be retrofitted to every device later.
Security by Design therefore supports compliance with IEC 62443, ISO 27001, NIS2 and the Dutch Cybersecurity Act.
🔧 What does Security by Design look like in practice?
| Design choice | Example | Related |
|---|---|---|
| Access management | Roles and permissions (RBAC) defined from the start, no shared accounts | Authentication, MFA |
| Encryption | Encryption of data at rest and in transit, with manageable certificates | Encryption, Certificate Management |
| Segmentation | Zones and conduits laid down in the architecture | Network Segmentation |
| Fail-safe defaults | Everything closed unless explicitly allowed; unused ports and services off | Hardening |
| Logging and auditing | Logging of changes and security events built in, with a feed to a SIEM | Logging |
| Patchability | Updates installed securely, verified and without long downtime | Firmware |
| Integrity | Only signed software is loaded, checked at every boot | Secure boot |
| Transparency | A list of software components ships with the product | SBOM |
A fail-safe default in the security sense means access is denied when nothing else has been decided. That is different from the fail-safe state of a process plant, but in OT both must be designed together: a security measure must never block a safety function.
🏭 Which standards and laws require Security by Design?
- IEC 62443-4-1 (2018) - defines the secure development lifecycle for suppliers in eight practices, one of which is literally called Secure by design (SD); certification is available through ISASecure SDLA
- IEC 62443-4-2 and IEC 62443-3-3 - technical requirements for components and systems per security level
- IEC 62443-3-2 - risk assessment and zoning, the basis for designing an installation
- Cyber Resilience Act (Regulation (EU) 2024/2847) - Annex I requires a design based on a risk assessment, delivery secure by default with a reset to the original state, and a limited attack surface; in addition, the manufacturer must provide a support period with security updates of, as a rule, at least five years; full application from 11 December 2027
- Machinery Regulation (EU) 2023/1230 - from 20 January 2027, control systems must withstand reasonably foreseeable malicious attempts (essential requirements 1.1.9 and 1.2.1)
- NIST SP 800-82 - US guide to OT security with architecture recommendations
🛒 How do you demand Security by Design when buying OT?
In January 2025 CISA, the Dutch NCSC, Germany’s BSI, the European Commission (DG CONNECT) and other partners published the Secure by Demand guide for OT owners and operators. It lists twelve elements to look for in suppliers:
| Element | What to look for |
|---|---|
| Configuration management | Control, track and securely back up changes to configuration and logic |
| Logging in the baseline product | Log changes, security and safety events in open formats, in every product version |
| Open standards | Interoperability and migration without lock-in |
| Ownership | Ability to carry out maintenance and changes without the vendor |
| Protection of data | Integrity and confidentiality of configuration and process data |
| Secure by default | No default passwords; SNMPv1/2, Telnet, SSL and TLS 1.0/1.1 disabled by default |
| Secure communications | Certificates that are easy to manage and do not stop the process when they expire |
| Secure controls | Resilient to malicious emergency, safety and diagnostic commands and to active scanning |
| Strong authentication | RBAC and phishing-resistant MFA, no shared role-based passwords |
| Threat model | An up-to-date, detailed threat model of the product |
| Vulnerability management | Defined support period, free patches, SBOM and a disclosure policy |
| Upgrade and patch tooling | Documented update process, including moves to a supported operating system |
The guide aligns with security level 3 of IEC 62443-4-2 and 3-3 and with the CRA. Include these points in your specifications and supplier agreements, for example as a questionnaire in a tender.
🧭 How do you apply Security by Design in an OT project?
- Establish the context - inventory assets, data flows and critical functions, and record security objectives alongside process objectives. Involve cybersecurity specialists at this stage, not only at handover.
- Build a threat model - use STRIDE or attack trees for the cyber side and combine them with the HAZOP or other safety analysis, so cyber scenarios with physical consequences become visible.
- Carry out a risk assessment - following IEC 62443-3-2, divide the installation into zones and conduits and assign a target security level to each zone.
- Choose the architecture - combine Defense in Depth, segmentation and, where possible, Zero Trust principles, with secure remote access.
- Set supplier requirements - ask for a secure development lifecycle (SDLC) in line with IEC 62443-4-1, with code reviews and security testing, SBOMs, a support period and secure-by-default delivery.
- Verify before commissioning - test the configuration with a penetration test or review during FAT and SAT, and check that default passwords and test accounts are gone.
- Embed it in operations - document security decisions and risk trade-offs, and revisit the design at every significant change.
❓ Frequently asked questions
What is the difference between Security by Design and Privacy by Design?
Security by Design focuses on protecting systems and data against attacks, disruption and manipulation. Privacy by Design focuses on protecting personal data and is mandatory under the GDPR (AVG in Dutch) as data protection by design. In OT the two overlap, for example in camera footage and access logging.
Is Security by Design a legal requirement?
Security by Design becomes mandatory for manufacturers through the Cyber Resilience Act, which applies in full from 11 December 2027, and through the Machinery Regulation from 20 January 2027. Organisations covered by NIS2 and the Dutch Cybersecurity Act must also take appropriate measures, including security in the acquisition, development and maintenance of systems.
Can you apply Security by Design to existing installations?
Security by Design is most effective in new builds, but in an existing installation you apply it at every modernisation, extension or replacement. For legacy systems that cannot be made secure, you compensate with segmentation, monitoring and strict access control. Every replacement cycle is an opportunity to choose secure-by-default products.
What role does IEC 62443 play in Security by Design?
IEC 62443 translates Security by Design into concrete requirements for the whole chain: 4-1 for the supplier’s development process, 4-2 and 3-3 for the technical capabilities of components and systems, and 3-2 for the risk-based design of an installation. This lets the manufacturer, integrator and asset owner each demonstrate that security was built in from the design stage.
Does Security by Design make a system more expensive?
Security by Design costs time up front for threat modelling, requirements and testing, but it avoids expensive rework, extra security products and downtime later. In OT, where systems last for decades, built-in measures are usually cheaper than ones added afterwards. Missing security features are also increasingly grounds for exclusion in procurement.
What is an example of a design flaw that Security by Design prevents?
A common design flaw is a PLC or HMI shipped with a default password and an open management interface, making it directly exploitable from the internet. In late 2023 attackers took over internet-exposed PLCs this way, including at a US water utility. Security by Design prevents this with unique credentials, unnecessary services disabled and logging from first commissioning.
📌 In summary
Security by Design means security is not an afterthought but a core requirement in every design choice, from the first threat model to the last update. For OT, where systems last for decades and patching is difficult, it delivers safer and more manageable installations. With IEC 62443, the Cyber Resilience Act and the Machinery Regulation, it is also shifting from good practice to legal obligation.