Security by Design Baseline

Purpose

Security by Design means controls are defined as mandatory architecture and delivery requirements before workloads are integrated.

Baseline guidelines

• Least privilege by default: Restrict permissions to explicit use cases and separate duties.
• Secure-by-default setup: Projects start with mandatory baseline settings and no insecure defaults.
• Defense in depth: Combine identity, network, workload, and data controls.
• Encryption by default: Require encryption in transit and at rest with clear key ownership.
• Traceable control ownership: Assign each control to an accountable owner and verification cadence.

Recommended baseline requirements

• Identity and access: Central identity integration, role model, privileged access control, and periodic access reviews.
• Network and connectivity: Segmentation policy, ingress and egress controls, and approved hybrid paths.
• Workload hardening: Compute and runtime hardening baseline, patching policy, and restricted management access.
• Secrets and keys: Centralized secret handling and key life cycle governance.
• Logging and evidence: Mandatory onboarding to audit and operational telemetry.

STACKIT references

• Security hardening: Security In Networks and Security In Compute Engine
• Secrets and key management: Features Use Cases And Service Plans and KMS
• Audit and observability: Audit Log and Observability

Anti-patterns to avoid

• Checklist-only security by design: Requirements are documented but not enforced technically.
• Team-specific baseline variants: Inconsistent control levels for similar workload classes.
• Late hardening campaigns: Baselines are applied after go-live instead of before onboarding.