Software Security Principles

From http://www-128.ibm.com/developerworks/library/s-princ5.html

1. Identify and reinforce the weakest link.
2. Provide defense in depth, which means you should manage software risk by providing redundant security solutions. Usually, one level of redundancy is worthwhile; whether you need more depends on your particular project.
3. Secure failure: Make sure that if the system could possibly fail, it will fail in a secure manner.
4. Least privilege: Do not give out more privileges than necessary, and do not extend privileges longer than necessary.
5. Compartmentalization: Try to keep failures in one part of a system from having an impact on the rest of the system.
6. Keep it simple.
7. Privacy: Don't give out any unnecessary information.
8. It's hard to hide secrets.
9. Don't extend trust easily.
10. Trust the community.