Why security must be designed in in HLD - Design It to Understand It

Design: Security-First System Design

Focus on integrating security principles from the start of system design. Out of scope: detailed cryptographic algorithm design and hardware security modules.

Functional Requirements

FR1: Ensure data confidentiality, integrity, and availability

FR2: Protect user privacy and sensitive information

FR3: Prevent unauthorized access and data breaches

FR4: Comply with relevant security standards and regulations

FR5: Enable secure authentication and authorization

FR6: Detect and respond to security incidents promptly

Non-Functional Requirements

NFR1: System must handle 10,000 concurrent users securely

NFR2: API response latency p99 under 200ms including security checks

NFR3: Availability target of 99.9% uptime

NFR4: Security measures must not degrade user experience significantly

Think Before You Design

Questions to Ask

❓ Question 1

❓ Question 2

❓ Question 3

❓ Question 4

❓ Question 5

❓ Question 6

Key Components

Authentication and Authorization services

Encryption for data at rest and in transit

Secure API gateways and firewalls

Audit logging and monitoring systems

Role-based access control (RBAC)

Security incident and event management (SIEM)

Design Patterns

Defense in Depth

Least Privilege

Fail Secure

Secure by Design

Zero Trust Architecture

Threat Modeling

Reference Architecture

  +-------------------+       +---------------------+       +-------------------+
  |                   |       |                     |       |                   |
  |   Client Devices   +------>+  API Gateway (WAF)  +------>+ Authentication &  |
  |                   |       |                     |       | Authorization Svc |
  +-------------------+       +---------------------+       +---------+---------+
                                                                       |
                                                                       v
                                                             +-------------------+
                                                             |                   |
                                                             |   Application     |
                                                             |     Servers       |
                                                             |                   |
                                                             +---------+---------+
                                                                       |
                                                                       v
                                                             +-------------------+
                                                             |                   |
                                                             |   Database with   |
                                                             |  Encryption at    |
                                                             |    Rest & Audit   |
                                                             +-------------------+

Additional components:
- Monitoring & Logging System
- Security Incident Response
- Role-Based Access Control enforcement

Components

API Gateway with WAF

Nginx + ModSecurity or AWS API Gateway with WAF

Filter and block malicious requests before reaching backend

Authentication & Authorization Service

OAuth 2.0 / OpenID Connect server

Verify user identity and enforce access control

Application Servers

Stateless microservices

Business logic with embedded security checks

Encrypted Database

PostgreSQL with Transparent Data Encryption

Store data securely with encryption and audit logs

Monitoring & Logging System

ELK Stack or Splunk

Collect logs and detect suspicious activities

Role-Based Access Control (RBAC)

Implemented in Auth service and app

Limit user permissions to minimum necessary

Request Flow

1. Client sends request to API Gateway

2. API Gateway filters request using Web Application Firewall rules

3. Request forwarded to Authentication Service to verify user identity

4. Upon successful authentication, Authorization Service checks user permissions

5. Authorized request proceeds to Application Servers for processing

6. Application Servers interact with encrypted Database for data operations

7. All actions are logged and monitored for anomalies

8. Security alerts trigger incident response if suspicious activity detected

Database Schema

Entities: - User(id, username, hashed_password, roles) - Role(id, name, permissions) - Permission(id, name, description) - AuditLog(id, user_id, action, timestamp, resource) Relationships: - User to Role: Many-to-Many - Role to Permission: Many-to-Many - AuditLog linked to User for traceability

Scaling Discussion

Bottlenecks

Authentication service overload under high concurrent login attempts

API Gateway becoming a single point of failure

Database encryption overhead impacting latency

Monitoring system overwhelmed by log volume

Complexity in managing fine-grained access control at scale

Solutions

Use distributed authentication with caching tokens and rate limiting

Deploy multiple API Gateway instances with load balancing

Optimize encryption with hardware acceleration and selective encryption

Implement log sampling and scalable log storage solutions

Adopt attribute-based access control (ABAC) and automate policy management

Interview Tips

Time: Spend 10 minutes understanding security requirements and risks, 20 minutes designing the architecture with security components, 10 minutes discussing scaling and trade-offs, 5 minutes summarizing key points.

Emphasize importance of integrating security from the start to avoid costly fixes later

Discuss defense in depth and least privilege principles

Explain how each component contributes to security goals

Highlight trade-offs between security, performance, and usability

Show awareness of scaling challenges and mitigation strategies

Practice

1. Why is it important to include security in the system design from the beginning?

easy

A. Because security slows down the system and should be avoided

B. Because security can be added easily after development

C. Because users do not care about security

D. Because fixing security issues later is more expensive and risky

Solution

1. Step 1: Understand the cost of late security fixes

   Fixing security problems after the system is built often requires rework, causing delays and higher costs.

2. Step 2: Recognize the risk of ignoring early security

   Ignoring security early can lead to data breaches and loss of user trust, which are costly and damaging.

3. Final Answer:

   Because fixing security issues later is more expensive and risky -> Option D

4. Quick Check:

   Early security design = Cost saving and risk reduction [OK]

Hint: Security early saves cost and risk later [OK]

Common Mistakes:

• Thinking security can be added easily after development
• Assuming users don't care about security
• Believing security always slows down systems

2. Which of the following is a correct security design practice to include from the start?

easy

A. Encrypting sensitive data during storage and transmission

B. Ignoring authentication to speed up development

C. Using default passwords for all users

D. Allowing open access to all system components

Solution

1. Step 1: Identify secure data handling methods

   Encrypting data protects it from unauthorized access both when stored and during communication.

2. Step 2: Eliminate insecure options

   Ignoring authentication, using default passwords, or open access are insecure and expose the system to attacks.

3. Final Answer:

   Encrypting sensitive data during storage and transmission -> Option A

4. Quick Check:

   Encryption = Secure data handling [OK]

Hint: Encrypt data to protect it always [OK]

Common Mistakes:

• Skipping authentication for speed
• Using default or weak passwords
• Allowing unrestricted access

3. Consider a system designed without early security measures. What is the likely outcome when a data breach occurs?

medium

A. The breach causes loss of user trust and costly fixes

B. The breach improves system performance

C. The breach has no effect if data is public

D. The system can quickly fix the breach without impact

Solution

1. Step 1: Understand consequences of data breaches

   A data breach exposes sensitive information, damaging user trust and requiring expensive fixes.

2. Step 2: Reject incorrect outcomes

   Quick fixes without impact are unrealistic; breaches never improve performance; public data assumption is unsafe.

3. Final Answer:

   The breach causes loss of user trust and costly fixes -> Option A

4. Quick Check:

   Data breach = Trust loss + Costly fixes [OK]

Hint: Breaches cost trust and money [OK]

Common Mistakes:

• Assuming breaches have no impact
• Thinking breaches improve performance
• Believing fixes are always quick and cheap

4. A system was built without authentication and encryption. What is the main security flaw to fix?

medium

A. Disable logging to improve speed

B. Add authentication and encrypt data communication

C. Remove all user access controls

D. Use default passwords for all users

Solution

1. Step 1: Identify missing security features

   Authentication verifies users; encryption protects data in transit. Both are essential for security.

2. Step 2: Exclude harmful fixes

   Removing access controls, disabling logging, or using default passwords worsen security risks.

3. Final Answer:

   Add authentication and encrypt data communication -> Option B

4. Quick Check:

   Authentication + Encryption = Secure system [OK]

Hint: Add auth and encryption to fix security [OK]

Common Mistakes:

• Removing access controls
• Disabling logs to speed up
• Using default passwords

5. You are designing a new online service. Which approach best ensures security is built in from the start?

hard

A. Focus on features first; security can be patched later

B. Add security features only after the system is fully developed

C. Plan authentication, encryption, and secure communication before coding

D. Use default settings and rely on network firewalls only

Solution

1. Step 1: Recognize best security design practice

   Planning authentication, encryption, and secure communication early integrates security deeply and reduces risks.

2. Step 2: Understand risks of delayed security

   Adding security late or relying only on firewalls leaves many vulnerabilities and increases costs.

3. Final Answer:

   Plan authentication, encryption, and secure communication before coding -> Option C

4. Quick Check:

   Early security planning = Strong protection [OK]

Hint: Design security features before coding [OK]

Common Mistakes:

• Delaying security until after development
• Relying only on network firewalls
• Ignoring security to speed up features