Ten Security Design Strategies from 2004

Camillo Särs revisits an internal security training he built at F-Secure in 2004, walking through its ten principles for designing software that holds up against attackers. He opens with the background of the original deck, which was written for a software engineering team, and sets up the question of what has changed since.

The middle of the talk goes through the principles. He starts with learning from earlier security work, such as 1980s military thinking and the OWASP Top 10, then covers protecting the weakest link, separating duties, and enforcing least privilege with both positive and negative testing. Old Internet Explorer ActiveX problems and an FFmpeg-based thumbnailing service, where untrusted media was treated as hostile, illustrate these points. He also covers defense in depth as time-based protection, never trusting input, failing safely, secure defaults, patching as an ongoing state, dependency management, architectural simplicity, and the limits of asking users security questions. The Thompson "trusting trust" compiler attack serves as a reason to question what you depend on.

The closing section argues that modern frameworks, safe languages, automated dependency checks, immutable ephemeral containers, and short-lived credentials have absorbed many of these lessons. His practical advice is to prioritise the architectural fixes that reduce exposure most, rather than working through long risk spreadsheets, and to be able to explain why each change matters.