Saltzer and Schroeder's Design Principles
Eight design principles for building secure systems, published by Jerome Saltzer and Michael Schroeder in 1975 and still used as the foundation of security engineering today.
Also known as: Saltzer and Schroeder Principles, Fail-Safe Defaults, Economy of Mechanism, Complete Mediation, Psychological Acceptability, Separation of Privilege, Least Common Mechanism, Open Design
Category: Principles
Tags: security, cybersecurity, software-design, software-architecture, principles, defaults
Explanation
In 1975, Jerome Saltzer and Michael Schroeder published "The Protection of Information in Computer Systems". The paper is about protection mechanisms in operating systems, but one section aged remarkably well: a list of eight design principles. Half a century later, they still show up in security courses, standards and code reviews.
**The eight principles**:
1. **Economy of mechanism**: Keep the design as simple and small as possible. Every extra line of code is a place where a bug can hide (see the KISS principle)
2. **Fail-safe defaults**: Base access decisions on permission, not exclusion. By default, access is denied, and you explicitly grant what's needed. A mistake then blocks a legitimate user (which gets noticed and fixed), instead of letting an attacker in (which may go unnoticed)
3. **Complete mediation**: Check every access to every object, every time. Don't cache a permission decision and assume it stays valid
4. **Open design**: The security of a system should not depend on keeping its design secret. Only keys and passwords should be secret (an idea that goes back to Kerckhoffs's principle in cryptography)
5. **Separation of privilege**: Where possible, require two independent conditions to grant access (e.g., two keys, two-factor authentication, two people approving a deploy)
6. **Least privilege**: Every program and every user should operate with the minimum set of privileges needed to do the job
7. **Least common mechanism**: Minimize the mechanisms shared between users, because every shared channel is a potential path for information to leak
8. **Psychological acceptability**: The protection mechanism must be easy to use, so people apply it routinely and correctly. If security is painful, people work around it
The paper also mentions two principles borrowed from physical security, with less confidence that they apply to computers: **work factor** (compare the cost of breaking the system with the attacker's resources) and **compromise recording** (keep reliable records that a breach happened, even if you can't prevent it).
**Why they still matter**:
Look at modern security practices, and you'll find these principles everywhere. Zero trust is complete mediation at network scale. Role-based access control is least privilege. Secure by Default is fail-safe defaults applied to configuration. Psychological acceptability is the Pit of Success, decades before the term existed: if the secure way is hard, people won't use it.
Related Concepts
← Back to all concepts