SoK: The Design Paradigm of Safe and Secure Defaults
Jukka Ruohonen

TL;DR
This paper systematically reviews the evolution, adoption, and challenges of the 'safe and secure defaults' paradigm in security engineering, highlighting its expansion and application since the 1970s.
Contribution
It provides a comprehensive systematization of knowledge on the paradigm through a mapping study and review, detailing its historical development, contextual adoption, and associated design principles.
Findings
The paradigm has been extensively discussed and adopted since the 1990s.
Recent literature shows accelerated publication growth post-2010s, especially with IoT security concerns.
New security principles like 'off by default' and 'zero trust' have been integrated into the paradigm.
Abstract
In security engineering, including software security engineering, there is a well-known design paradigm telling to prefer safe and secure defaults. The paper presents a systematization of knowledge (SoK) of this paradigm by the means of a systematic mapping study and a scoping review of relevant literature. According to the mapping and review, the paradigm has been extensively discussed, used, and developed further since the late 1990s. Partially driven by the insecurity of the Internet of things, the volume of publications has accelerated from the circa mid-2010s onward. The publications reviewed indicate that the paradigm has been adopted in numerous different contexts. It has also been expanded with security design principles not originally considered when the paradigm was initiated in the mid-1970s. Among the newer principles are an "off by default" principle, various overriding and…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Security and Verification in Computing · Physical Unclonable Functions (PUFs) and Hardware Security
