Insecure Design

Insecure design refers to fundamental design flaws rather than implementation bugs. It represents a category of weaknesses expressed as missing or ineffective control design.

Examples

• No rate limiting on authentication endpoints
• Security questions that can be easily guessed
• Insecure password recovery flows
• Missing business logic validation

Prevention

• Use threat modeling during design
• Establish secure development lifecycle
• Use secure design patterns
• Write abuse case stories alongside user stories
• Implement security requirements from the start