Thanks, so software by design would be handled more by the software team and CM would have more to do with making it secure by default?

@CharlesOwen: If you mean with CM the configuration management at the customer side then no - the software should come secure by default already without requiring specific customer configuration.

I meant CM from the supplier side.

@CharlesOwen: I'm not familiar with having a separate CM which only cares how the software is configured and is not integrated with software development. From my perspective implementing how a software gets configured and to ensure that the defaults are secure is a part of software development.

Thanks, but back to my original question. Which of these two principles would be viewed as more secure?

@CharlesOwen: "Which of these two principles would be viewed as more secure?" One might say that secure by default is the easier one to achieve while deeply implemented security by design has more impact but takes also much more effort. But at the end both are needed.

I agree that these are complementary but I don't have the exact context but it came up as a practice question on an exam asking which one was MOST secure. My guess would be secure by design because that's a more comprehensive approach. I agree the context matters.

If it is not secure by default it can be fixed by the customer by applying the proper secure configuration. If it is not secure by design it cannot be fixed by the customer.

I'm not here to get answers for a test but I am trying to understand the concepts. I recently took an CSSLP exam and I remember a question like this arising. A lot of the time the questions will be framed in a manner that something is BEST, MOST SECURE, etc. Another words, a couple of the answers could apply but one has precedence. I want to stress that I'm looking to learn and master the concepts. The training material for this class was terrible.

I really recommend to read the publication I've linked to. I think it is very well written

I have been reading it and I think CISA resources are going to be very good for me. I'm also a development lead and I'm trying to implement the best practices in the industry for security.

This CSSLP had 125 questions. You can't go back. Once you've answered a question that's it. I missed it by 2 questions. The resources for this exam are truly terrible. I'm trying to find the best resources for mastering these concepts. I just don't want to pass in order to "check off a box." I was ble to do a dump on paper after the exam of all the questions I thought were on the exam. Obviously I can't remember all of them, more or less bits and pieces.

I'm finding that there isn't much of a demand for this certification now but maybe that changes in the future. Passing the exam would be an expected result of mastering the concepts. ISC2 provides a list of 20 resources to study for exam. Well that's merely 10,000 pages of material and you'd likely spend a 1000 dollars on the books.

But from everything I'm seeing, I did pick the best answer for that question. SECURE BY DESIGN

If the question is this way then I would probably have picked security by design too. But its a terrible question