Security from First Principles

Chapter 4. Minimization

In order for three people to keep a secret, two must be dead.

Benjamin Franklin

The Principle: Minimize the size, quantity, and complexity of what is to be protected, and limit externally facing points of attack.

Key Question: Can this be a smaller target?

Related Concepts: Attack Surface, Compactness, Data Minimization, Simplicity

Minimization is the Principle of reducing needless size, complexity, and overly burdensome assets. Rather than burn resources attempting to secure ever-expanding data sets, systems, and networks, Minimization makes the practitioner’s job easier by reducing the number of things to care about, and by extension, the number of things that can go wrong.

Minimization is the principle of keeping things as small and simple as possible. Rather than erecting more walls, putting in place more checks, and hiring more guards, Minimization improves security by reducing the number of things that can go wrong, the number of points open to attack, the duration of high-risk exposure, the value of the assets you have to protect,¹ and the consequences of failures. Every piece of information you store and every bit of complexity you add comes with a cost, and those costs must be weighed against the benefit that the addition provides. Even though it’s often tempting to add more security when faced with a problem, the drawbacks of that added security can prove more damaging than doing nothing at all, and the better option still would be to further ...