SecAppDev original
Secure by Design — Ideas and Techniques
Video and handoutsSecAppDev 2026
-
-
Abstract
Most security vulnerabilities aren’t introduced by careless developers. They’re made possible by design decisions that nobody flagged as security decisions at the time.
This session introduces Secure by Design as a way of thinking, not a checklist. We’ll look at how everyday design choices — how you model your domain, define your types, draw your boundaries — can close down attack surfaces. The same thinking that makes code correct and maintainable tends to make it secure. Security becomes a property that emerges from good design rather than a layer bolted on afterwards.
Handouts available for this lecture
DownloadChapters
- Introduction, agenda, and goals
- Bank robbery and security as a concern
- Digital security and the CIA+T triad
- Secure by Design as a method
- Integrity: modeling a hotel room
- Domain primitives and semantic validation
- Domain primitives as intelligent building blocks
- Applying domain primitives to legacy code
- Confidentiality and implicit data leakage
- Read-once pattern for sensitive values
- Traceability and logging as a subsystem
- Second-order injection and domain-oriented logging APIs
- Availability and advanced persistent threats
- Cloud patterns for flexible systems
- Rotate, repave, repair, and final takeaways
In-person course
Dan Bergh Johnsson and Daniel Deogun taught at a previous edition of SecAppDev
SecAppDev is an immersive course in secure application development, running annually since 2005. World-renowned faculty from industry and academia deliver in-depth 90-minute lectures and full-day workshops in an intimate setting, typically in early June.
More about SecAppDev