Economy of Mechanism and Keep It Simple
What you'll learn: Why simpler security designs are actually stronger and more trustworthy than complex ones.
The Core Idea
"Economy of Mechanism" means keeping your security systems as simple as possible. The principle is straightforward: the simpler a design, the fewer places bugs and vulnerabilities can hide. Complex systems are harder to understand, harder to test, and harder to secure properly.
Think of it like a door lock. A simple deadbolt has one mechanism—turn the key, slide the bolt. You can inspect it, understand how it works, and verify it's locked. Now imagine a lock with seventeen moving parts, electronic sensors, and three backup systems. More things can break, malfunction, or be exploited. The complexity itself becomes a security weakness.
Why Simplicity Matters for Security
When you apply Complete Mediation (checking every access), Least Privilege (minimal permissions), or Defense in Depth (multiple layers), you're already building multiple components. If each component is unnecessarily complex, the combined system becomes nearly impossible to audit or verify.
Simple designs are:
- Easier to audit: Security reviewers can actually understand what's happening
- Easier to test: Fewer paths mean more thorough testing
- Easier to maintain: Future updates are less likely to introduce new vulnerabilities
- Easier to verify: You can be confident the system does exactly what you think it does
This doesn't mean oversimplifying to the point of weakness—it means avoiding unnecessary complexity. If Separation of Duties requires two components, use two. Don't add a third "just in case."
Key Takeaway: In security, simplicity is strength—simpler systems have fewer places for vulnerabilities to hide and are easier to verify as correct.