CISSP 8.1 - Secure Design Principles (Part 2 of 3)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series continues secure design principles from Domain 3, turning to how systems should behave when things go wrong and why simpler is safer. It covers failing securely, graceful error handling, the fail-safe and fail-secure choice, and how simplicity and explainable AI shrink and expose risk.

Frequently Asked Questions

What does it mean to fail securely?

Failing securely means a system is designed ahead of time to land in a safe, predictable state when something breaks. Failure can come from countless causes, but what matters is how the system responds. A program only fails securely because a developer planned for it, like an aircraft engineered so that even a hydraulic loss still leaves the pilot able to land. The safe outcome is not luck, it was built in.

How do you handle errors and bad input gracefully?

You start with error handling, sometimes called exception handling, which is code that anticipates problems and deals with them before they crash the program. Many languages offer a try-catch structure, placing risky code in the try branch and recovery code in the catch branch. Then you guard the front door with input validation, checking user input for length, filtering out known-bad patterns, and neutralizing dangerous characters like a bouncer inspecting every guest before the door.

What is the difference between fail-safe and fail-secure?

Both describe a complete failure but protect different things. A gentler option, fail-soft, lets a system keep running after one component dies, like a multitasking computer where one crashed app does not take down the others. When full failure is unavoidable, fail-safe protects people first, so a door unlocks in an emergency to let everyone escape. Fail-secure protects assets first, so a vault door locks itself down when an alarm trips.

How do fail-safe and fail-secure flip between the physical and digital worlds?

Context changes their meaning, so pin down which world you are in. In the physical world, a fail-open response leans toward availability and is called fail-safe, while a fail-closed response leans toward protection and is called fail-secure. In the digital world, fail-open keeps a connection flowing to protect availability, like a firewall passing traffic if it crashes, while fail-closed cuts the connection to protect confidentiality and integrity. Always ask first whether you are physical or digital.

Why does simplicity make a system easier to protect, and how does explainable AI extend that?

Complexity is where security hides and breaks: more code means more to test, more parts means more places to fail, and more features means a larger attack surface. The keep-it-simple principle favors not repeating yourself, building only what you need now, and using the least powerful tool that works. Explainable AI carries that transparency into machine learning, since a black-box model can conceal bias, flaws, or tampering, while explainable and interpretable models let you trace how an input produced an output.

Reference: This article is based on concepts discussed in CISSP 8.1 - Secure Design Principles (Part 2 of 3).