Software Engineering › Key terms › Y12 Secure Software Architecture › Security by design
Security by design
Term Key terms bank Y12 Secure Software Architecture
Definition
Building security into the software from the start of development rather than adding it at the end.
Example: Security by design uses cryptography and sandboxing from the first design step.
Found in: syllabus, school notes.
Security built in from the start.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Multiple choice: Pick the option that matches the definition or example.
- Short answer: Explain the contribution of cryptography and sandboxing
- Extended response: Use it as a supporting point linked to the stimulus.
Where it has appeared in the paper
Secure Software Architecture (Part B, C). Part letters follow each paper’s own layout.
Related past questions
- Familiarisation Q6 (3 marks): Sandboxing Secure Software Architecture (Part C) · 3 marks
- Sample exam Q3 (1 mark): Encryption Secure Software Architecture (Part B) · 1 mark
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: Security by design in Secure Software Architecture (Year 12) · study that set
- Memorise: Cryptography and sandboxing in 'security by design'
- Key terms bank entry: Security by design
- Notes: Use and explain the contribution of cryptography and sandboxing to the ‘security by… (Secure Software Architecture (Year 12))
- Notes: Cryptography and sandboxing in 'security by design' (Secure Software Architecture (Year 12))
How to use it in an answer
A model sentence
“Building security into the software from the start of development rather than adding it at the end.” Then apply it: Security by design uses cryptography and sandboxing from the first design step.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
- Identify: Recognise and name. (Sample exam Q3 (1 mark): Encryption)
Technique for the question types
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
- Extended response: Plan with the command word, give a judgement or explanation supported by named details from the stimulus, use course terms and cover both sides when asked.
What the marking guidelines and feedback say
Answers could include: sandboxing limits the resource use of different processes running on the device, ensuring that if a process contains bad code, such as a memory leak, it does not consume all the resources of the operating system.
Worked answers from the marking guidelines
Familiarisation Q6 (3 marks): Sandboxing (3 marks): criteria and sample answer
Criteria
3: Thorough discussion of the use of sandboxing in the operating system. 2: Some understanding of the advantages and/or disadvantages. 1: Identifies a feature of sandboxing.
Sample answer
Sandboxing allows each application to be isolated so that it cannot pose a security risk by accessing system resources or other applications. However, it requires more resources as each application requires its own container. It may also be less convenient for users to access resources such as the device's camera or files as the sandbox will either prevent access or make it more difficult.
Sample exam Q3 (1 mark): Encryption (1 mark): criteria and sample answer
Criteria
1: Identifies the correct answer.
Sample answer
Implement data encryption
Common mistakes
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Cryptography · Sandboxing · Privacy by design · Proactive not reactive · Embed privacy into design · Respect for user privacy