Generation STEM
Learning LibrarySecurity LibraryTeens

The security mindset: assume nothing, verify everything

Security isn't a tool you install. It's a way of thinking. The security mindset means trusting nothing by default and verifying everything — especially who is allowed to do what.

The big idea

The security mindset defaults to distrust: grant the least access needed, validate every input, and ask what could go wrong before it does.

See it in code

1The basics

The heart of the mindset is one rule: deny by default. Nothing is allowed unless it's on the list. Here delete isn't listed, so it's refused:

python
# Deny by default: only allow what's on the list.
allowed = ["read"]
action = "delete"
if action in allowed:
    print(f"{action}: ALLOW")
else:
    print(f"{action}: DENY")
Run it — an action that isn't on the list gets denied:
delete: DENY

The list holds only read, so everything else is a DENY. Starting from 'no' — and saying 'yes' on purpose — is the whole idea.

2A step further

Now check several actions against that allow-list at once. Each one is measured against the same list — allowed, or not:

python
# Check each action against the allow-list.
allowed = ["read", "write"]
for action in ["read", "write", "delete"]:
    ok = action in allowed
    print(f"{action}: {'ALLOW' if ok else 'DENY'}")
Run it — each action is checked against the allow-list:
read: ALLOW
write: ALLOW
delete: DENY

read and write are on the list; delete isn't, so it's denied. Same deny-by-default rule, now applied across a whole set of actions.

3In our world

Real systems check who is asking, too. This is least privilege: give each user only the permissions they truly need. The check still starts from 'deny' and allows only what's explicitly listed for that user:

python
# The security mindset: assume nothing, verify everything.
def check_access(user, action):
    # least privilege: only allow what's explicitly permitted
    allowed = {"admin": ["read", "write", "delete"], "guest": ["read"]}
    return action in allowed.get(user, [])

for user, action in [("guest", "read"), ("guest", "delete"), ("admin", "delete")]:
    ok = check_access(user, action)
    print(f"{user} wants to {action}: {'ALLOW' if ok else 'DENY'}")
Run it — access is denied unless explicitly granted:
guest wants to read: ALLOW
guest wants to delete: DENY
admin wants to delete: ALLOW

The default is DENY. allowed.get(user, []) returns an empty list for anyone unknown, so an unlisted user can do nothing. That 'deny by default, allow on purpose' stance is the mindset in action. So is validating inputs and imagining how something could be misused — a habit called threat modeling.

The same idea, everywhere

Defaulting to caution, and verifying instead of trusting, is wise well beyond code. You double-check a suspicious email. You confirm a source before sharing. You test an assumption before betting on it. The security mindset is really just critical thinking applied to systems.

Try it yourself

Add a 'moderator' role with its own permission list, and test it. Then flip the bug in on purpose: change the default to allow everything, and see how a single careless default opens the door to everyone.

The common mistake

Trusting by default — assuming input is clean, users are honest, and nothing unexpected happens. Attackers, and plain accidents, live in the cases you didn't consider. Starting from distrust, and checking everything, is what catches them.

What it unlocks

The mindset draws on conditionals and dictionaries, applies what a vulnerability is, and is inseparable from ethical hacking ethics.

Related concepts