u The design should avoid and work around any security-endangering
weaknesses in the environment or development tools.
u The number of components to be trusted should be minimized.
u The system should be designed to do only what the specification calls