Tightening & Loosening

Many software manufacturers publish hardening guides to help customers lock down unsafe default configurations.

But secure-by-design software should ship with safe defaults, flipping the model.

If customers need 50+ page hardening guides to be safe, your defaults are not doing their job.

A secure-by-design system favors starting with tight defaults and loosening deliberately, rather than shipping permissive defaults. We call these "loosening guides".

Discussion prompts

• What are the default security settings in your product — and are they as tight as they could be? Why/why not?
• Have you loosened a security control in response to user feedback? Was it the right call for all users?
• What would it take to make your most permissive default more restrictive?