Secure by DesignSoftware can be much safer than it is today.
Welcome to securebydesign.software, a place to explore the ideas behind the Secure by Design movement. This site is here to help you understand what it means to build safer, more resilient software, and the part you play in making that happen. Whether you're a developer, executive, customer, or policymaker, you'll find insights, principles, and thought-provoking questions to help you shift from reactive security to intentional design.
Modern economies run on software. Hospitals, banks, power grids, water systems, supply chains, and governments all depend on it. When software fails, the harm lands on people who did not choose the product and could not inspect it.
Software insecurity is not a law of nature. It is the result of choices about design, incentives, and accountability.
The failures are not mysterious
Many breaches begin with a defect in a product, and many of those defects belong to classes the field has understood for decades. Fixing them one at a time, after release, has not worked.
This is an incentives problem
Software makers can ship defective products and pass most of the cost to customers, operators, and the public. When the maker bears little of the cost of insecurity, the market underproduces safety. Other industries that once treated safety as the customer's problem, such as automobiles, changed when makers were held accountable for what they built.
Secure by design is the answer
Build safety in from the start. Eliminate whole classes of defect, ship with safe defaults, publish honest data about defects, and put accountability with the makers who control the design. Operators should not have to compensate for products that were built unsafe.