Which principle does the router follow?

Radical transparency and accountability

Which secure by design principle does this action best show?

Embracing radical transparency and accountability

Taking ownership of customer security outcomes by adding features

Building organizational structure and leadership

Which of the following best describes secure by design?

Letting customers decide which security features to turn on

Adding a firewall after a product is released

Testing a product only after an attack

Which set of characters are control characters that applications use to encase user input?

Single quote, double quote, semicolon

Which of the following attacks does input sanitization help protect against?

Ransomware, worms and logic bombs

An insider copying files they are already allowed to read

Password spraying, credential stuffing and brute force attacks

AP® Cybersecurity 5.5 Protecting Applications: Secure by Design, Secure by Default, Input Sanitization

1. Secure by design and secure by default (5.5.A)

Secure by design is an initiative that encourages companies to include security in all phases of product development, including design. Security becomes a design principle, not just a technical feature 5.5.A.1. It has three principles 5.5.A.2:

Principle	What it looks like
Take ownership of customer security outcomes	Build products that meet customers’ security needs
Embrace radical transparency and accountability	Share security-related product news and updates quickly, which raises security for everyone
Build organizational structure and leadership	Leaders focused on security, with a security-first posture

Secure by default is part of secure by design: security features of software and devices are enabled by default, so products are secure to use out of the box 5.5.A.3. A new smart speaker that forces you to set a unique password at first start, with automatic updates already switched on, is secure by default; one that ships with a shared factory password and updates turned off is not.

2. Input sanitization (5.5.B)

When users type into an application, it usually wraps the input in special characters to process it. These control characters include the single quote, the double quote and the semicolon 5.5.B.1.

Why a quote matters (simplified)

expected:  ... WHERE city = 'Lisbon'
typed:     Lisbon'; DELETE FROM bookings; --
becomes:   ... WHERE city = 'Lisbon'; DELETE FROM bookings; --'
# the quote ends the text, the semicolon starts a new command

Programmers should use a verification function to check that input meets the expected criteria and contains no control characters that could manipulate the system. The function can sanitize the input by removing potentially malicious characters, or give the user an error and make them enter different input 5.5.B.2. For example, removing or encoding the < and > characters means a <script> tag can never form, and removing ../ stops a path from climbing directories. This protects against:

SQL injection attacks
Cross site scripting (XSS) attacks
Directory traversal attacks

Review real form submissions below and decide which ones the verification function should stop.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

Secure by design principlesOwn it, share it, lead it: ownership of customer outcomes, radical transparency, security-first leadership.
Control charactersQuote, double quote, semicolon: the characters that wrap input.

Common misconceptions

"Secure by design is a feature you add at the end."
Not quite. It makes security a design principle in all phases of product development, not just a technical feature.
"Secure by default means the product can be made secure in the settings."
Not quite. It means security features are already enabled, so the product is secure to use out of the box.
"Sanitizing input means encrypting it."
Not quite. Sanitizing removes potentially malicious characters, or rejects the input and asks for different input.

Exam traps

The three secure by design principles are about the company: ownership of customer security outcomes, radical transparency and accountability, and organizational structure and leadership.
A verification function can either sanitize (remove dangerous characters) or reject the input with an error.
Input sanitization protects against SQL injection, XSS and directory traversal attacks.

By the numbers

Say each list out loud, then tap to check.

3 secure by design principles Say them, then tap

take ownership of customer security outcomes
embrace radical transparency and accountability
build organizational structure and leadership

3 control characters Say them, then tap

single quote
double quote
semicolon

3 attacks input sanitization blocks Say them, then tap

In 30 seconds

Secure by design: security in all phases of product development, including design.
Its principles: ownership of customer security outcomes; radical transparency and accountability; organizational structure and leadership for a security-first posture.
Secure by default: security features enabled out of the box.
Control characters (', ", ;) encase user input; a verification function sanitizes or rejects input, protecting against SQL injection, XSS and directory traversal.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Input	Value
I1	Okonkwo
I2	van der Berg
I3	Smith'; DELETE FROM guests
I4	Nakamura

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

Secure by designtap to flip

An initiative to include security in all phases of product development, including design; companies own customer security outcomes, are radically transparent and build security-first leadership.
Example and CED codes
Secure by defaulttap to flip

The idea that security features of software and devices are enabled by default, so products are secure out of the box.
Example and CED codes
Control characterstap to flip

Characters an application uses to encase user input, including the single quote, the double quote and the semicolon.
Example and CED codes
Input sanitizationtap to flip

Using a verification function to remove potentially malicious characters from user input, or reject it, before processing.
Example and CED codes
Data validationtap to flip

Verifying that user input meets the expected criteria, such as digits for a quantity, before processing it, and rejecting anything outside the expected parameters.
Example and CED codes
SQL injectiontap to flip

An attack that places structured query language (SQL) commands and control characters into an input field, so the application returns too much data or changes and deletes data.
Example and CED codes
Cross site scripting (XSS)tap to flip

An attack that injects malicious code into a website so the user's browser runs it; Type I is reflected (in a link) and Type II is stored (posted on the site).
Example and CED codes
Directory traversaltap to flip

An attack that edits uniform resource locators (URLs) and hypertext transfer protocol (HTTP) GET requests, usually with ../, to reach sensitive files outside a web application's folder.
Example and CED codes

Questions students ask

What is the difference between secure by design and secure by default?

Secure by design puts security into every phase of building a product. Secure by default is part of it: the product ships with its security features already turned on.

What are control characters?

Characters an application uses to encase user input so it can process it: the single quote, the double quote and the semicolon. Adversaries type them to break out of the input and change what the program does.

How does input sanitization protect an application?

A function checks that the input meets the expected criteria and contains no control characters. It removes potentially malicious characters or makes the user enter something else, blocking SQL injection, XSS and directory traversal.

5.5 Protecting Applications