that should be applied when designing a secure system. In DHS’ Secure
Software, [216] the Saltzer and Schroeder principles were analyzed, and the
following subset was identified as directly relevant to software security assurance:
u Least Privilege—Least privilege is a principle whereby each principal