Overview
ISO/IEC TS 19249:2017 - Information technology - Security techniques - Catalogue of architectural and design principles for secure products, systems and applications - is a technical specification that catalogs proven architectural and design principles to support the development and assessment of secure products, systems and applications. The document provides guidance on how to use those principles effectively, offers examples and evaluation considerations, and links architectural/design choices to security properties - without imposing mandatory evaluation or implementation requirements.
Key Topics
The specification organizes principles into architectural and design categories and provides structured guidance for each, including purpose, usage, examples and evaluation considerations.
Architectural principles (selected):
- Domain separation - isolating functional or security domains and defining inter-domain communication.
- Layering - structuring software/hardware into layers with well-defined interfaces.
- Encapsulation - hiding internal implementation to reduce exposure and enforce interfaces.
- Redundancy - replicating components to increase availability and resilience while managing consistency.
- Virtualization - isolating resources and mapping virtual to physical resources securely.
Design principles (selected):
- Least privilege - granting minimal privileges required for tasks.
- Attack surface minimization - reducing accessible interfaces and functionality exposed to untrusted parties.
- Centralized parameter validation - validating input consistently to prevent injection and misuse.
- Centralized general security services - reusing common security functions (auth, crypto, logging).
- Preparing for error and exception handling - designing fail-safe behaviors and secure error reporting.
Important attributes:
- Guidance for applying principles to support specific security properties (confidentiality, integrity, availability).
- Examples and practical trade-offs (usability, performance).
- Considerations for evaluation to assist developers and evaluators in judging how well principles support claimed security properties.
Applications
ISO/IEC TS 19249:2017 is useful for:
- Security architects and system designers selecting architecture and design patterns for secure products, systems and applications.
- Software developers implementing secure design practices (least privilege, input validation, encapsulation).
- Product managers and risk owners assessing design choices for security trade-offs (availability vs. redundancy).
- Security evaluators and assessors mapping design/architecture to security properties during assessments (note: the TS does not mandate evaluation procedures).
Practical uses include secure platform design, secure application development, hardening virtualized environments, and preparing design documentation for security assessment.
Related Standards
- ISO/IEC 15408 (all parts) - Evaluation criteria for IT security (Common Criteria).
- ISO/IEC 18045 - Methodology for IT security evaluation.
- ISO Online browsing platform / IEC Electropedia for normative definitions.
ISO/IEC TS 19249:2017 is a guidance resource linking architectural and design best practices to security objectives, helping teams design and evaluate secure systems while complementing formal evaluation frameworks.