Course Outline · Beginner Friendly · 2026
This short course teaches you how to build security into a system from the very beginning. You will learn why it is better to plan for safety first instead of fixing problems later. No technical experience needed.
| Item | Details |
|---|---|
| Level | Beginner |
| Duration | 2 weeks · 2–3 hours per week |
| Modules | 3 modules + 1 final project |
| Tools | Pen and paper (a computer is optional) |
| Certificate | Yes, after the final project |
This course contains 3 modules plus a final project.
Learn what Security by Design means and why it matters for every project.
Explain Security by Design and why it matters in simple words.
Learn the main rules that make a system safe from the very beginning.
Name and explain at least four principles of secure design.
Learn how to think about threats early and build systems that stay safe.
Create a simple threat model for a small project.
Choose a simple system (for example, a school portal, a small shop, or a family budget app). Write a short plan that explains:
Present your plan to a friend, teacher, or family member. This becomes your portfolio piece.
After this course, you can continue to Introduction to Secure Coding, where you will learn how to write code that follows Security by Design principles.
Security by Design · Beginner Level · 2026
Welcome to the first module of Security by Design. This is the start of a very important journey. By the end of this module, you will understand what Security by Design means and why it matters for every project.
Have you ever built a house with cardboard? You start with a plan. You decide where the walls will go. You decide where the door will be. You decide how strong the roof should be. You do all of this before you build anything.
Security by Design means planning for safety from the very beginning. It means thinking about what could go wrong before you build, and building in a way that stops problems from happening.
Imagine building a house without planning for a lock. You finish the house and then realise there is no place for a lock on the door. Now you must break the door to add one. That is what happens when we do not think about security first.
In this module, you will learn what Security by Design means. You will learn why planning for safety first is much better than fixing things later. You will also see examples from real life, school, home, and Nigeria.
This module is written for complete beginners. You do not need to know any coding. Every new word is explained in very simple language. So relax, read slowly, and let us begin.
YOUR LEARNING JOURNEY IN MODULE 1
=================================
[ Start ]
|
V
What is Security by Design?
|
V
Building Security In from the Start
|
V
The Cost of Fixing Security Later
|
V
Real-Life Examples
|
V
Why Everyone Can Use It
|
V
[ You understand Security by Design! ]
This module introduces Security by Design. You will learn what it means, why it matters, and how it saves time, money, and stress. Everything is explained in simple language with plenty of examples.
By the end of this module, you will be able to:
You will learn what Security by Design is, why it matters, and how it saves time, money, and stress.
Chidi is a 12-year-old boy who lives in Lagos. He loves building things. One Saturday, he decided to build a small clubhouse in the backyard.
Chidi was excited. He ran to the backyard with wood, nails, and a hammer. He started building immediately.
He built the walls. He built the roof. He built a small door. It looked wonderful. Chidi was very proud of his clubhouse.
But that night, it rained heavily. The next morning, Chidi ran to the backyard. The clubhouse was ruined. The roof had leaked. The walls had fallen. The wood was wet and broken.
His father came out. "Chidi, what happened?"
"The rain destroyed it, Papa," Chidi said sadly.
"Did you plan the clubhouse before you built it?" his father asked.
"No, Papa. I just started building."
His father smiled gently. "That is the problem. You did not plan for the rain. If you had planned first, you would have used stronger wood. You would have made a better roof. You would have placed the clubhouse on higher ground."
Chidi understood. "So I should have thought about the rain before I built it."
"Exactly," his father said. "That is what Security by Design means. Think about the problems before you build. Then build so the problems cannot happen."
The next week, Chidi rebuilt the clubhouse. This time, he planned first. He used stronger wood. He built a better roof. He placed it on higher ground. That clubhouse lasted for many years.
CHIDI'S CLUBHOUSE ================= First try: [ Build fast ] -> [ No plan ] -> [ Rain destroyed it ] Second try: [ Plan first ] -> [ Strong materials ] -> [ Safe from rain ]
Chidi's first clubhouse was destroyed because he did not plan for the rain. His second clubhouse survived because he planned first. This story introduces the whole module.
In this section, you will go through 12 short lessons. Each lesson teaches one big idea. Each lesson ends with a mini summary. Read slowly. Think about the examples. Ask questions. That is how you learn.
Security by Design means planning for safety from the very beginning of any project. It means thinking about what could go wrong before you build.
If you plan for safety first, you save time, money, and stress. If you fix security later, it is harder and costs more.
Think of building a house. Before you lay the first brick, you decide where the doors, windows, and locks will go. Security by Design is the same for computers, apps, and systems.
A bank plans how to protect money before it opens. It does not wait for a robbery to think about security.
A school plans how to protect student records before creating a portal. It does not wait for a hack.
Your family plans how to protect the Wi-Fi with a password before strangers connect.
Nigerian banks plan how to protect customer money before they open online banking.
SECURITY BY DESIGN
==================
[ Plan first ]
|
V
[ Think about problems ]
|
V
[ Build with safety ]
|
V
[ System is safe from the start ]
Security by Design means planning for safety from the very beginning. It saves time, money, and stress.
Building security in from the start means adding safety as you build, not after. It is part of the plan, like a door on a house.
When security is part of the plan, it fits naturally. When it is added later, it may not fit at all.
Think of baking a cake. You add sugar while mixing. You do not bake the cake first and then try to add sugar. Security works the same way.
A hospital plans how to protect patient records before the system is built.
A school plans passwords and permissions before launching a portal.
Your family decides on a strong Wi-Fi password before setting up the router.
Nigerian fintechs plan how to protect money before launching their apps.
BUILDING SECURITY IN ==================== [ Plan ] -> [ Build with security ] -> [ Safe system ] Not: [ Build ] -> [ Then add security ] -> [ Problems ]
Building security in from the start means making safety part of the plan, not an afterthought.
Fixing security later means adding protection after the system is already built. It costs more money, takes more time, and can still leave problems.
Fixing later is like repairing a wall after it collapses. It is much easier to build it strong from the beginning.
Think of painting a house. It is easy to paint while building. It is very hard to paint after furniture and carpets are in place. Security works the same way.
A company builds a website without security. Hackers break in. The company spends millions to fix it and loses customers.
A school builds a portal without strong passwords. Students change scores. The school must rebuild the system.
Your family sets up Wi-Fi without a password. Strangers use the internet. You must change everything.
Nigerian banks that add security after a breach spend much more than those that plan first.
COST OF FIXING LATER
====================
[ Build without security ]
|
V
[ Problem happens ]
|
V
[ Expensive fix ]
|
V
[ Lost time, money, and trust ]
Fixing security later costs more money, takes more time, and can still leave problems.
Thinking about what could go wrong means imagining problems before they happen. It is part of Security by Design.
If you think about problems first, you can plan for them. If you ignore them, they will surprise you.
Think of going on a trip. You pack an umbrella in case it rains. You pack snacks in case you get hungry. Thinking about problems is the same.
A bank asks, "What if someone steals a customer's card?" and plans protections before they happen.
A school asks, "What if a student shares their password?" and plans how to reset it.
Your family asks, "What if someone breaks into the Wi-Fi?" and uses a strong password.
Nigerian banks ask, "What if a fraudster pretends to be a customer?" and use 2FA.
THINK ABOUT WHAT COULD GO WRONG
===============================
[ What if someone steals it? ]
[ What if someone breaks it? ]
[ What if the wrong person sees it? ]
|
V
[ Plan for each problem ]
|
V
[ System stays safe ]
Thinking about what could go wrong helps you plan for safety before problems happen.
Good design includes safety from the start. Bad design ignores safety until it is too late.
Knowing the difference helps you build better systems and spot problems early.
Think of two cars. One has airbags and seat belts. The other has none. Both cars can drive, but only one protects you in an accident.
| Good Design | Bad Design |
|---|---|
| Safety planned from start | Safety added later |
| Problems thought through | Problems ignored |
| Costs less to maintain | Costs more to fix |
| Users trust it | Users worry about it |
A bank app with 2FA is good design. A bank app without any security is bad design.
A school portal with strong passwords is good design. One without is bad.
A Wi-Fi router with a password is good design. One without is bad.
Nigerian banks with strong security are good design. Those without lose customer money.
GOOD vs BAD DESIGN ================== Good: [ Plan ] -> [ Build with safety ] -> [ Safe system ] Bad: [ Build ] -> [ Ignore safety ] -> [ Problem happens ]
Good design includes safety from the start. Bad design ignores safety until it is too late.
Security by Design saves money because problems are prevented before they happen.
Every problem that does not happen saves money. Security is cheaper than fixing breaches.
Think of repairing a roof. Fixing a small leak is cheap. Rebuilding a fallen roof is expensive.
A bank that plans security first saves millions compared to one that pays for a breach.
A school that plans security saves the cost of rebuilding a hacked portal.
Your family saves money by preventing strangers from using your Wi-Fi.
Nigerian banks that plan security save money on fraud recovery.
SAVING MONEY
============
[ Plan security first ]
|
V
[ No breach ]
|
V
[ No lost money ]
|
V
[ More profit ]
Security by Design saves money by preventing problems before they happen.
Security by Design saves time because you do not have to rebuild or repair later.
Time is valuable. Fixing a problem takes much longer than planning for it.
Think of writing a school essay. If you plan first, you finish faster. If you write without a plan, you must rewrite it many times.
A company that plans security does not have to stop work to fix a breach.
A school that plans security does not lose time rebuilding a hacked portal.
Your family saves time by setting up Wi-Fi correctly the first time.
Nigerian banks with good planning spend less time responding to incidents.
SAVING TIME
===========
[ Plan first ]
|
V
[ Build once ]
|
V
[ No repairs ]
|
V
[ Time saved ]
Security by Design saves time because you do not have to rebuild or repair later.
Real-life examples help us see how Security by Design is used in the world around us.
Seeing real examples helps you understand and remember the idea.
Think of your school. It has a fence, a gate, and a watchman. These were planned before the school was built.
A car factory plans where to place airbags before the car is built.
A school plans a fence and gate before opening.
Your family plans where to install locks before moving into a new house.
Nigerian banks plan their vaults and security systems before opening.
SECURITY BY DESIGN EVERYWHERE ============================= Cars: Seat belts, airbags Houses: Locks, strong doors Banks: Vaults, cameras Websites: Passwords, 2FA Phones: Fingerprint locks All planned before building.
Security by Design is everywhere — in cars, houses, banks, websites, and phones.
Security by Design is not only for big companies. Anyone can use it — students, parents, teachers, and small businesses.
Everyone builds or plans something. Everyone can plan for safety.
Think of a student planning a school project. They plan what to do, what could go wrong, and how to fix it.
A student plans how to keep their school portal password safe.
A teacher plans how students will log in safely.
Your family plans how to protect your Wi-Fi and devices.
A small Nigerian trader plans how to keep customer payments safe.
EVERYONE CAN PLAN ================= [ Student ] -> Safe passwords [ Parent ] -> Safe Wi-Fi [ Teacher ] -> Safe classroom [ Trader ] -> Safe payments [ Business ]-> Safe systems
Anyone can use Security by Design. It is for students, parents, teachers, traders, and businesses.
Security by Design is part of your daily life. Every safe habit you have was planned.
Understanding daily examples helps you see the idea everywhere.
Think of your morning routine. You lock your door, carry your keys, and take your phone. These habits were planned.
Your family plans where to keep the spare key — not under the mat.
Your school plans where to keep exam papers — in a locked cupboard.
Your family plans how to keep the Wi-Fi password private.
A Nigerian family plans how to keep their gate locked at night.
DAILY LIFE ========== [ Lock the door ] [ Use a PIN ] [ Check the door ] [ Keep wallet close ] [ Keep Wi-Fi password private ] All were planned for safety.
Security by Design is part of everyday life. Every safe habit was planned.
When security is forgotten, problems happen. Hackers, thieves, and accidents cause damage.
Knowing what happens when security is forgotten helps you plan better.
Think of a house without a lock. Anyone can walk in. Systems without security are the same.
A company loses customer data because it forgot to plan security.
A school's exam questions are leaked because no one planned security.
Your family's Wi-Fi is used by strangers because no password was set.
Many Nigerian businesses have closed because of cyber attacks they did not plan for.
WHEN SECURITY IS FORGOTTEN
==========================
[ No plan ]
|
V
[ No security ]
|
V
[ Attack or accident ]
|
V
[ Money lost, trust lost ]
When security is forgotten, money is lost, trust is broken, and systems fail.
A Security by Design thinker is someone who always asks "what could go wrong?" before building anything.
This habit protects you, your family, and your projects.
Think of a careful planner. They always check the weather, the route, and the time before leaving. A Security by Design thinker does the same for projects.
A student plans their school project with safety in mind.
A student asks, "What if my password is stolen?" and plans for it.
Your family asks, "What if a stranger uses our Wi-Fi?" and sets a password.
A Nigerian trader asks, "What if a customer's payment fails?" and plans a backup.
BECOMING A THINKER
==================
[ Ask "what could go wrong?" ]
|
V
[ Plan for problems ]
|
V
[ Build with safety ]
|
V
[ Protect yourself and others ]
A Security by Design thinker always asks "what could go wrong?" before building.
| Word | Simple Definition |
|---|---|
| Security by Design | Planning for safety from the very beginning. |
| Plan | Deciding what to do before doing it. |
| Design | The way something is built or arranged. |
| Good design | Building with safety from the start. |
| Bad design | Ignoring safety until it is too late. |
| Breach | When someone breaks into a system. |
| Trust | When people feel safe using your system. |
| Risk | The chance that something will go wrong. |
| Thinker | Someone who asks good questions and plans well. |
These words are the foundation of Security by Design. Use them often so they become easy.
Think about safety before you build. It is much easier than fixing later.
Preventing a problem is cheaper and faster than repairing it.
This question helps you plan for problems before they happen.
Students, parents, teachers, and businesses can all use Security by Design.
When security is forgotten, money, time, and trust are lost.
These five concepts are the heart of Module 1. Read them again before moving on.
USING SECURITY BY DESIGN
========================
[ Understand ] -> [ Ask "what could go wrong?" ]
-> [ Plan ] -> [ Build safely ]
-> [ Test ] -> [ Review ]
QUESTIONS TO ASK ================ [ Who will use it? ] [ What could go wrong? ] [ Who might attack it? ] [ What could be stolen? ] [ How to protect it? ] [ What if it fails? ]
SPOTTING GOOD DESIGN ==================== [ Safety planned? ] -> Yes [ Many layers? ] -> Yes [ Simple? ] -> Yes [ Protects users? ] -> Yes [ Recovers? ] -> Yes
Using Security by Design, asking questions, and spotting good design all follow simple steps. Follow them, and your projects stay safe.
A bank plans where the vault will be before building. It plans where cameras go. It plans how money is protected.
A hospital plans where patient records are stored and who can see them.
A school plans student passwords and permissions before opening a portal.
An online shop plans how payments are protected before selling anything.
A government office plans how national data is protected from the start.
Security by Design is used in banks, hospitals, schools, shops, and government offices.
Banks plan secure vaults, cameras, and 2FA before opening.
Fintechs like Paystack plan how payments are protected from the start.
Universities plan how to protect student records before building portals.
Agencies like NITDA plan how to protect national systems.
Families plan Wi-Fi passwords and PINs before setting up devices.
Nigeria has many examples of Security by Design in banks, fintechs, schools, government, and families.
A good sandcastle is built on firm ground, with strong walls, and away from the water. That is planning for safety.
You plan the recipe, the ingredients, and the temperature before baking.
The coach plans the formation before the match. That is planning for success.
You plan the building before putting the bricks together.
You plan a safe route, wear a helmet, and check the brakes. That is Security by Design.
Security by Design is like building a sandcastle, baking a cake, playing football, building with LEGO, and riding a bicycle.
| Situation | Security by Design Idea |
|---|---|
| Locking the door | Planning safety before leaving |
| Setting a Wi-Fi password | Planning protection before use |
| Using a PIN on your card | Planning protection for money |
| Planning a family trip | Planning for problems before travelling |
| Planning a project | Planning for safety before building |
Even simple daily activities use Security by Design. Now you can see it everywhere.
Parents can teach Security by Design at home through daily conversations and simple examples.
Security by Design is powerful and saves money, time, and trust.
Security by Design is full of surprises. The more you learn, the more useful it becomes.
These ten points are the heart of Module 1. Read them again before moving on.
Avoiding these mistakes will make you better at Security by Design than many adults.
These ten practices will help you build safer systems and safer habits.
SECURITY BY DESIGN
==================
[ Plan first ]
|
V
[ Think about problems ]
|
V
[ Build with safety ]
|
V
[ System is safe from the start ]
BUILDING SECURITY IN ==================== [ Plan ] -> [ Build with security ] -> [ Safe system ] Not: [ Build ] -> [ Then add security ] -> [ Problems ]
COST OF FIXING LATER
====================
[ Build without security ]
|
V
[ Problem happens ]
|
V
[ Expensive fix ]
|
V
[ Lost time, money, and trust ]
THINK ABOUT WHAT COULD GO WRONG
===============================
[ What if someone steals it? ]
[ What if someone breaks it? ]
[ What if the wrong person sees it? ]
|
V
[ Plan for each problem ]
|
V
[ System stays safe ]
GOOD vs BAD DESIGN ================== Good: [ Plan ] -> [ Build with safety ] -> [ Safe system ] Bad: [ Build ] -> [ Ignore safety ] -> [ Problem happens ]
BECOMING A THINKER
==================
[ Ask "what could go wrong?" ]
|
V
[ Plan for problems ]
|
V
[ Build with safety ]
|
V
[ Protect yourself and others ]
These diagrams help you see Security by Design clearly. Draw them yourself to remember them better.
| Good Design | Bad Design |
|---|---|
| Safety planned from start | Safety added later |
| Problems thought through | Problems ignored |
| Costs less to maintain | Costs more to fix |
| Users trust it | Users worry about it |
| Plan First | Fix Later |
|---|---|
| Cheaper | More expensive |
| Faster | Slower |
| Safer | Riskier |
| Keeps trust | Loses trust |
| Thing | Security by Design |
|---|---|
| Cars | Seat belts, airbags |
| Houses | Locks, strong doors |
| Banks | Vaults, cameras, 2FA |
| Websites | Passwords, HTTPS |
| Phones | Fingerprint locks |
Comparing ideas side by side helps you remember the differences clearly.
| Lesson | Main Idea |
|---|---|
| Lesson 1 | Security by Design means planning safety first. |
| Lesson 2 | Build security in from the start. |
| Lesson 3 | Fixing security later costs more. |
| Lesson 4 | Ask "what could go wrong?". |
| Lesson 5 | Good design plans safety; bad design ignores it. |
| Lesson 6 | Security by Design saves money. |
| Lesson 7 | Security by Design saves time. |
| Lesson 8 | Real-life examples show it everywhere. |
| Lesson 9 | Everyone can use it. |
| Lesson 10 | It is part of daily life. |
| Lesson 11 | Forgotten security is expensive. |
| Lesson 12 | Anyone can become a Security by Design thinker. |
Congratulations! You have completed Module 1. Let us review what you have learned.
You began by learning that Security by Design means planning for safety from the very beginning.
You discovered how to build security in from the start — making safety part of the plan.
You learned the cost of fixing security later — more money, more time, and more stress.
You explored thinking about what could go wrong before you build.
You learned to recognise good and bad design.
You discovered how Security by Design saves money.
You learned how it saves time.
You explored real-life examples in cars, houses, banks, websites, and phones.
You learned that everyone can use Security by Design — students, parents, teachers, and businesses.
You discovered how it is part of daily life.
You learned what happens when security is forgotten.
Finally, you learned how to become a Security by Design thinker.
MODULE 1 SUMMARY MAP
====================
[ What is Security by Design? ]
|
V
[ Plan Safety First ] -> [ Ask "What Could Go Wrong?" ]
|
V
[ Cost of Fixing Later ] -> [ Good vs Bad Design ]
|
V
[ Real-Life Examples ] -> [ Everyone Can Plan ]
|
V
[ Daily Life ] -> [ Forgotten Security is Expensive ]
|
V
[ Security by Design Thinker! ]
Well done! You now have a strong foundation. In Module 2, you will learn the main principles of secure design.
Security by Design means planning for safety from the very beginning of any project.
Because planning for safety first saves time, money, and stress.
It costs more money, takes more time, and can still leave problems.
"What could go wrong?"
No. Everyone can use it — students, parents, teachers, and small businesses.
Cars with seat belts and airbags are good examples of Security by Design.
It prevents problems before they happen, so you do not pay for breaches.
You build once instead of repairing or rebuilding later.
Money, time, and trust are lost. Systems fail. Businesses close.
You will learn the main principles of secure design, like keeping it simple, least privilege, and defence in depth.
| Column A (Word) | Column B (Meaning) |
|---|---|
| 1. Security by Design | A. When someone breaks into a system |
| 2. Plan | B. Planning for safety from the very beginning |
| 3. Breach | C. The chance that something will go wrong |
| 4. Risk | D. Deciding what to do before doing it |
| 5. Trust | E. When people feel safe using your system |
Answers: 1-B, 2-D, 3-A, 4-C, 5-E
| Column A (Question) | Column B (Purpose) |
|---|---|
| 1. "What could go wrong?" | A. Know who uses it |
| 2. "Who will use it?" | B. Plan for problems |
| 3. "What could be stolen?" | C. Plan for recovery |
| 4. "What if it fails?" | D. Protect information |
Answers: 1-B, 2-A, 3-D, 4-C
Matching helps you connect words to meanings quickly.
A school is building a new student portal. They want to launch it next week.
Questions:
Your family just bought a new Wi-Fi router. It does not have a password yet.
Questions:
A trader wants to start selling products online. She is ready to launch today.
Questions:
These scenarios help you apply what you have learned to real situations.
Group size: 3–5 students
Time: 40 minutes
Materials: Paper, pencil
Instructions:
Goal: To practise Security by Design as a team.
Time: 20 minutes
Materials: Notebook, pencil
Instructions:
Goal: To practise Security by Design on your own idea.
Time: 1–2 hours
Materials: Paper, pencil, colour pencils
Instructions:
Goal: To practise designing a safe system from the start.
Time: 1 week
Materials: Notebook, pencil
Instructions:
Goal: To see Security by Design in the real world.
You have finished Module 1. Well done! Here is how to prepare for Module 2, which is all about Principles of Secure Design.
TRANSITION TO MODULE 2
======================
[ Module 1: What is Security by Design? ]
|
V
[ Module 2: Principles of Secure Design ]
|
V
[ You will learn: keep it simple, least privilege,
defence in depth, fail safely, and more ]
See you in Module 2. Keep thinking like a Security by Design thinker!
End of Module 1 — What is Security by Design?
⬅ Back to Course Outline | Go to Module 2 ➡
Security by Design · Beginner Level · 2026
Security by Design · Beginner Level · 2026
Welcome to Module 2. In Module 1, you learned what Security by Design means. You learned that it is about planning for safety from the very beginning. You also learned why it saves time, money, and stress.
Now we go one step further. You will learn the main principles of secure design. A principle is like a rule or a guide. When you follow good principles, your design stays safe.
Think of building a bridge. Engineers follow principles like "use strong materials," "build on solid ground," and "test before opening." Security has its own principles too.
In this module, you will learn six big principles. You will learn to keep things simple. You will learn about least privilege, defence in depth, failing safely, not trusting input, and keeping your design open. Each one protects you in a different way.
This module is written for complete beginners. You do not need to know any coding. Every new word is explained in very simple language. Every principle comes with examples from real life, school, home, and Nigeria. So relax, read slowly, and let us begin.
YOUR LEARNING JOURNEY IN MODULE 2
=================================
[ Start ]
|
V
Keep It Simple
|
V
Least Privilege
|
V
Defence in Depth
|
V
Fail Safely
|
V
Do Not Trust Input
|
V
Keep It Open
|
V
[ You know the principles of secure design! ]
This module teaches you the six main principles of secure design. Each principle helps you build safer systems from the start.
By the end of this module, you will be able to:
You will learn six principles of secure design and how to apply them in daily life.
Tunde is a 12-year-old boy who lives in Ibadan. He loves collecting special things — coins, stamps, and small toys. He keeps them in a wooden box in his room.
One day, Tunde's mother gave him three smaller boxes. "You can use these to organise your collection," she said.
Tunde thought about it. He had an idea.
First, he put all his coins in Box A. Then he put his stamps in Box B. Then he put his small toys in Box C. He labelled each box clearly.
Next, he placed all three small boxes inside the big wooden box. He locked the big box with a key.
But that is not all. He also placed a small padlock on each of the three smaller boxes.
His friend Chidi came to visit. "Why so many locks?" Chidi asked.
"Because if someone opens the big box, they still cannot open the small boxes without their own keys," Tunde said.
"But why organise them in small boxes?" Chidi asked.
"Because it is easier to find things. And if one box is broken, the others are still safe."
Chidi was impressed. "You have designed your collection well!"
Tunde smiled. He had used several principles without knowing their names. He had kept things simple. He had used many layers of protection. He had given each box only what it needed. His design was strong.
TUNDE'S BOXES
=============
[ Big Box with Lock ]
|
+-- [ Small Box A ] + padlock
+-- [ Small Box B ] + padlock
+-- [ Small Box C ] + padlock
Many locks = Defence in Depth
Small boxes = Keep It Simple
Each box has its key = Least Privilege
Tunde organised his collection with three small boxes inside a big box. He used several locks and separate keys. Without knowing their names, he used the principles of secure design. This story introduces the whole module.
In this section, you will go through 12 short lessons. Each lesson teaches one big idea. Each lesson ends with a mini summary. Read slowly. Think about the examples. Ask questions. That is how you learn.
A principle is a rule or guide that helps you make good decisions. It is a simple idea you follow again and again.
Principles help you stay consistent. When you follow good principles, you make fewer mistakes.
Think of a football coach. They have principles like "always pass the ball" and "keep your shape." A security designer has principles too.
A carpenter follows the principle "measure twice, cut once."
A student follows the principle "read the question twice before answering."
Your family follows the principle "lock the door before going out."
A trader follows the principle "count your money twice before closing."
PRINCIPLES ARE GUIDES
=====================
[ Principle ] -> [ Good decision ]
[ Principle ] -> [ Good decision ]
[ Principle ] -> [ Good decision ]
|
V
[ Consistent, safe results ]
A principle is a rule or guide that helps you make good decisions. Principles keep you consistent.
Keep It Simple means designing things in the easiest way possible. It means avoiding unnecessary parts.
Simple systems are easier to understand and easier to protect. Complicated systems have more places for problems.
Think of a bicycle. It has two wheels, a chain, and brakes. A car has thousands of parts. A bicycle is easier to fix. Simple designs are safer.
A bank login page asks for your username and password. It does not ask for 20 other details. It is simple.
A school portal asks for your exam number and password. Simple.
Your Wi-Fi password is one strong phrase. It does not have a hundred rules.
A POS machine asks for the amount and PIN. It does not ask for unnecessary details.
KEEP IT SIMPLE
==============
Simple: [ User ] -> [ Password ] -> [ Login ]
Complex: [ User ] -> [ Password ] -> [ OTP ]
-> [ Secret Question ] -> [ Birthday ]
-> [ Colour ] -> [ Pet Name ] -> [ Login ]
Simple is easier to protect.
Keep It Simple means designing things in the easiest way possible. Simple systems are easier to protect.
Least Privilege means giving each person only the access they need to do their job. Nothing more.
If someone has more access than they need, a mistake or hack can cause more damage.
Think of a school. The head teacher has keys to every room. A student only has access to their classroom. Students do not need keys to the staff room.
A bank teller can help customers. They cannot access the bank's main vault. That is least privilege.
A student can check their own results. They cannot change anyone's scores.
Your younger brother can watch TV. He cannot change the family bank account.
A POS operator can collect payments. They cannot access the business owner's full bank account.
LEAST PRIVILEGE =============== [ Head Teacher ] -> All rooms [ Teacher ] -> Classroom + Staff Room [ Student ] -> Classroom only [ Visitor ] -> Front gate only Each has only what they need.
Least Privilege means giving each person only the access they need. Nothing more.
Defence in Depth means using many layers of protection. If one layer fails, the others still protect you.
No single protection is perfect. Many layers make you much safer.
Think of a castle. It has a moat, walls, gates, and guards. If someone crosses the moat, they still face the walls. Defence in Depth is the same idea.
A bank has security guards, cameras, alarms, and vaults. Many layers.
A school has a gate, a fence, and a watchman. Many layers.
Your house has a gate, a door lock, and a window lock. Many layers.
A Nigerian bank has guards, cameras, alarms, and vault doors. Many layers of protection.
DEFENCE IN DEPTH
================
[ Password ]
|
V
[ 2FA ]
|
V
[ Antivirus ]
|
V
[ Firewall ]
|
V
[ Backup ]
Many layers. Attackers must pass them all.
Defence in Depth means using many layers of protection. If one fails, the others still protect you.
Fail Safely means that when something goes wrong, the system should protect users instead of exposing them.
Systems will fail sometimes. The way they fail matters. Failing safely prevents damage.
Think of a door that locks automatically when the power goes off. That is failing safely.
When a bank ATM loses network, it stops giving money. That is failing safely.
If the school portal fails, students cannot change scores. That is failing safely.
If the Wi-Fi goes down, your devices do not share your passwords. That is failing safely.
If a Nigerian bank's mobile app fails, it locks your account until you log in again. That is failing safely.
FAIL SAFELY
===========
[ Something goes wrong ]
|
V
[ System locks down ]
|
V
[ No data is exposed ]
|
V
[ Users are protected ]
Fail Safely means that when something goes wrong, the system protects users instead of exposing them.
Do Not Trust Input means always checking what users type or send. Never assume it is safe.
Attackers use input to break into systems. If you check everything, you stay safe.
Think of a teacher marking exams. They check every answer. They do not assume every answer is correct.
A website asks for your phone number. It checks that you typed numbers, not letters.
A school portal checks that your exam number has the correct format.
Your family checks a text message before clicking any link.
A Nigerian bank checks every transaction for suspicious details before allowing it.
DO NOT TRUST INPUT
==================
[ User input ] -> [ Check it ] -> [ If good, accept ]
-> [ If bad, reject ]
Never trust input directly.
Do Not Trust Input means always checking what users type or send. Never assume it is safe.
Keep It Open means not relying on secrecy as your only protection. Your design should be safe even if everyone knows how it works.
Secrets often leak. If your system is safe without secrets, you are stronger.
Think of a lock. Everyone knows how a lock works. But only you have the key. The lock is safe even though its design is open.
Everyone knows how a bank's security cameras work. But the cameras still protect the bank.
Everyone knows how the school's exam rules work. But students still cannot cheat.
Everyone knows how a house lock works. But only your family has the key.
Everyone knows how Nigerian bank cards work. But only you have your PIN.
KEEP IT OPEN
============
[ Everyone knows how the lock works ]
|
V
[ But only you have the key ]
|
V
[ System stays safe ]
Keep It Open means not relying on secrecy as your only protection. Your design should be safe even if everyone knows how it works.
Using principles together means applying more than one rule at the same time. This makes your design even stronger.
Each principle protects you in a different way. Together, they build a much safer system.
Think of a football team. Passing, defending, and scoring all matter. Using them together wins matches.
A bank uses all six principles at once. That is why banks are hard to rob.
A school uses simple portals, limited access, and backups. All together.
Your home uses locks, alarms, and safe habits. All together.
Nigerian banks use all six principles to protect customers.
ALL PRINCIPLES TOGETHER
=======================
[ Keep It Simple ]
[ Least Privilege ]
[ Defence in Depth ]
[ Fail Safely ]
[ Do Not Trust Input ]
[ Keep It Open ]
|
V
[ Very strong design ]
Using principles together makes your design much stronger. Each one protects you in a different way.
Principles in real life means seeing how these ideas are used in banks, hospitals, schools, and homes.
Seeing them in real life helps you remember and apply them.
Think of a hospital. Patients have different access. Doctors have their own access. Visitors stay in the waiting area. That is least privilege.
A bank uses passwords (simple) and cameras (defence in depth).
A school uses simple portals and checks every exam number.
Your home uses locked doors (defence in depth) and safe habits (keep it simple).
Nigerian banks use many principles together to protect customer money.
PRINCIPLES IN REAL LIFE ======================= Banks: Simple + Defence Hospitals: Least Priv + Fail Safe Schools: Simple + No Trust Homes: Defence + Open
Principles are used everywhere — banks, hospitals, schools, and homes.
Principles in daily habits means using these ideas in small, everyday actions.
Small habits build strong security over time.
Think of brushing your teeth. It is small. But doing it daily protects you. Same for security principles.
A student checks their messages before clicking any link.
A student uses a different password for the school portal.
Your family sets a strong Wi-Fi password.
A Nigerian family covers their PIN at the ATM.
DAILY HABITS ============ Strong password -> Keep It Simple Do not share PIN -> Least Privilege Use 2FA -> Defence in Depth Log out -> Fail Safely Check messages -> Do Not Trust Input Teach family -> Keep It Open
Small daily habits use the principles of secure design. Together, they protect you.
Spotting missing principles means noticing when a design has forgotten one of the six principles.
When a principle is missing, the design is weaker. Spotting it helps you fix problems before they happen.
Think of a football team missing a goalkeeper. Anyone can score. That is a missing principle.
A website that asks for 20 details to log in is missing "Keep It Simple."
A portal where every student can see all results is missing "Least Privilege."
A Wi-Fi router without a password is missing "Defence in Depth."
A bank without OTPs is missing "Defence in Depth."
SPOTTING MISSING PRINCIPLES =========================== Too complex? -> Keep It Simple missing Everyone full access? -> Least Privilege missing One layer only? -> Defence in Depth missing Data exposed? -> Fail Safely missing Input unchecked? -> Do Not Trust Input missing Secrecy only? -> Keep It Open missing
Spotting missing principles helps you fix problems before they cause harm.
A secure designer is someone who uses the six principles every time they plan something.
This habit protects you, your family, and your projects. It prepares you for future work.
Think of a careful planner. They always consider safety, cost, and time. A secure designer always considers the six principles.
A student designs their class project with the six principles.
A student helps build a safer class portal.
Your family uses all six principles to protect their devices.
Nigerian cybersecurity professionals use the six principles daily.
BECOMING A SECURE DESIGNER
==========================
[ Learn principles ]
|
V
[ Ask which is missing ]
|
V
[ Apply in daily life ]
|
V
[ Teach others ]
|
V
[ Review and improve ]
A secure designer uses the six principles every time they plan something. Anyone can become one.
| Word | Simple Definition |
|---|---|
| Principle | A rule or guide that helps you decide. |
| Keep It Simple | Design in the easiest way possible. |
| Least Privilege | Give each person only what they need. |
| Defence in Depth | Use many layers of protection. |
| Fail Safely | When something goes wrong, protect users. |
| Input | What users type or send. |
| Do Not Trust Input | Always check what users send. |
| Keep It Open | Do not rely on secrecy alone. |
| Design | The way something is built or arranged. |
| Layer | One level of protection. |
| Access | Being able to use or see something. |
| Secure Designer | Someone who plans with the six principles. |
These words are the foundation of secure design. Use them often so they become easy.
Rules help you make good decisions again and again.
Simple systems are easier to protect and harder to break.
If one protection fails, the others still protect you.
Do not trust input. Do not rely on secrecy. Always verify.
When something goes wrong, the system should protect users.
These five concepts are the heart of Module 2. Read them again before moving on.
APPLYING THE SIX PRINCIPLES
===========================
[ Understand ]
|
V
[ Keep It Simple ]
|
V
[ Least Privilege ]
|
V
[ Defence in Depth ]
|
V
[ Fail Safely ]
|
V
[ Do Not Trust Input ]
|
V
[ Keep It Open ]
|
V
[ Safe design! ]
SPOTTING MISSING PRINCIPLES =========================== [ Complex? ] -> Keep It Simple missing [ Full access? ] -> Least Privilege missing [ One layer? ] -> Defence in Depth missing [ Data exposed? ] -> Fail Safely missing [ Unchecked? ] -> Do Not Trust Input missing [ Secrecy? ] -> Keep It Open missing
FIXING A WEAK DESIGN
====================
[ Identify missing principle ]
|
V
[ Plan the fix ]
|
V
[ Make the change ]
|
V
[ Test ]
|
V
[ Review ]
Applying principles, spotting missing ones, and fixing weak designs all follow simple steps. Follow them, and your design stays strong.
A bank uses all six principles: simple logins, limited access, many layers, safe failure, input checks, and open designs.
A hospital uses least privilege (doctors, nurses, visitors) and fail safely (protect records on failure).
A school uses simple portals, limited access, and input checks.
An online shop uses many layers and does not trust input.
A government office uses all six principles to protect national data.
The six principles are used in banks, hospitals, schools, shops, and government offices.
Nigerian banks use all six principles to protect customer money.
Paystack and Flutterwave use many layers and check every input.
Nigerian universities give different access to staff and students.
NITDA uses least privilege and defence in depth.
Families use defence in depth (locks, PINs, passwords).
Nigeria uses the six principles in banks, fintechs, schools, government, and families.
Each player has a role (least privilege). The coach plans many defences (defence in depth).
Each compartment holds a different food (keep it simple). You check food before eating (do not trust input).
Each item has a place (keep it simple). You zip it closed (defence in depth).
If one card falls, the house falls. Many layers would make it strong.
Games have many levels of defence (health, shields, armour).
The principles appear in football teams, lunchboxes, pencil cases, card houses, and video games.
| Situation | Principle |
|---|---|
| Locking your door | Defence in Depth |
| Using a PIN | Least Privilege |
| Simple Wi-Fi password | Keep It Simple |
| Checking messages | Do Not Trust Input |
| Logging out | Fail Safely |
Even simple daily actions use the six principles. Now you can see them everywhere.
Parents can teach the principles at home through daily conversations and simple examples.
The six principles are powerful and used everywhere.
The six principles are full of surprises. The more you learn, the more useful they become.
These ten points are the heart of Module 2. Read them again before moving on.
Avoiding these mistakes will make your designs stronger than most.
These ten practices will help you build strong, safe designs.
SIX PRINCIPLES OF SECURE DESIGN =============================== [ Keep It Simple ] [ Least Privilege ] [ Defence in Depth ] [ Fail Safely ] [ Do Not Trust Input ] [ Keep It Open ]
KEEP IT SIMPLE ============== Simple: [ User ] -> [ Password ] -> [ Login ] Complex: [ User ] -> [ Many steps ] -> [ Problems ]
LEAST PRIVILEGE =============== [ Head Teacher ] -> All rooms [ Teacher ] -> Classroom + Staff Room [ Student ] -> Classroom only [ Visitor ] -> Front gate only
DEFENCE IN DEPTH
================
[ Password ]
|
V
[ 2FA ]
|
V
[ Antivirus ]
|
V
[ Firewall ]
|
V
[ Backup ]
FAIL SAFELY
===========
[ Problem happens ]
|
V
[ System locks down ]
|
V
[ Users protected ]
BECOMING A SECURE DESIGNER
==========================
[ Learn principles ]
|
V
[ Spot missing ones ]
|
V
[ Apply daily ]
|
V
[ Teach others ]
|
V
[ Review and improve ]
These diagrams help you see the six principles clearly. Draw them yourself to remember them better.
| Principle | Meaning |
|---|---|
| Keep It Simple | Design in the easiest way possible. |
| Least Privilege | Give only what is needed. |
| Defence in Depth | Use many layers of protection. |
| Fail Safely | Protect users on failure. |
| Do Not Trust Input | Always check what users send. |
| Keep It Open | Do not rely on secrecy alone. |
| Simple Design | Complex Design |
|---|---|
| Easier to protect | Harder to protect |
| Fewer places for problems | Many places for problems |
| Easier to fix | Harder to fix |
| Users understand it | Users get confused |
| One Layer | Many Layers |
|---|---|
| One protection only | Many protections |
| Easy to break | Hard to break |
| Risky | Safe |
| Example: password only | Example: password + 2FA + antivirus |
Comparing ideas side by side helps you remember the differences clearly.
| Lesson | Main Idea |
|---|---|
| Lesson 1 | A principle is a rule or guide. |
| Lesson 2 | Keep It Simple means design in the easiest way. |
| Lesson 3 | Least Privilege means give only what is needed. |
| Lesson 4 | Defence in Depth means many layers. |
| Lesson 5 | Fail Safely means protect users on failure. |
| Lesson 6 | Do Not Trust Input means check everything. |
| Lesson 7 | Keep It Open means do not rely on secrecy. |
| Lesson 8 | Using principles together is strongest. |
| Lesson 9 | Principles appear in banks, hospitals, schools, homes. |
| Lesson 10 | Small daily habits use the principles. |
| Lesson 11 | Spotting missing principles prevents harm. |
| Lesson 12 | Anyone can become a secure designer. |
Congratulations! You have completed Module 2. Let us review what you have learned.
You began by learning that a principle is a rule or guide.
You learned to Keep It Simple — design in the easiest way possible.
You discovered Least Privilege — give each person only what they need.
You explored Defence in Depth — use many layers of protection.
You learned to Fail Safely — protect users when something goes wrong.
You discovered the principle of Do Not Trust Input — always check what users send.
You explored Keep It Open — do not rely on secrecy alone.
You learned how to use principles together for strong designs.
You found principles in real life — banks, hospitals, schools, homes.
You saw how daily habits use the principles.
You learned to spot missing principles in weak designs.
Finally, you learned how to become a secure designer.
MODULE 2 SUMMARY MAP
====================
[ Keep It Simple ]
|
V
[ Least Privilege ] -> [ Defence in Depth ]
|
V
[ Fail Safely ] -> [ Do Not Trust Input ] -> [ Keep It Open ]
|
V
[ Use Together ] -> [ Spot Missing ] -> [ Secure Designer! ]
Well done! You now understand the six principles of secure design. In Module 3, you will learn how to think about threats and build safe systems from the start.
A principle is a rule or guide that helps you make good decisions.
Design things in the easiest way possible. Avoid extra parts.
Give each person only the access they need. Nothing more.
Use many layers of protection. If one fails, the others still protect you.
When something goes wrong, the system should protect users instead of exposing them.
Attackers use input to break into systems. Always check what users send.
Do not rely on secrecy alone. Your design should be safe even if everyone knows how it works.
Yes. Using many together makes your design stronger.
Look at the design and ask if it is too complex, gives too much access, has only one layer, exposes data, trusts input, or relies on secrecy.
You will learn how to think about threats and build safe systems from the start.
| Column A (Principle) | Column B (Meaning) |
|---|---|
| 1. Keep It Simple | A. Give only what is needed |
| 2. Least Privilege | B. Use many layers |
| 3. Defence in Depth | C. Protect users on failure |
| 4. Fail Safely | D. Design in the easiest way |
| 5. Do Not Trust Input | E. Always check what users send |
| 6. Keep It Open | F. Do not rely on secrecy |
Answers: 1-D, 2-A, 3-B, 4-C, 5-E, 6-F
| Column A (Situation) | Column B (Principle) |
|---|---|
| 1. Locking your door | A. Least Privilege |
| 2. A student uses only their class portal | B. Defence in Depth |
| 3. Checking a link before clicking | C. Do Not Trust Input |
| 4. Using 2FA | D. Defence in Depth |
Answers: 1-B, 2-A, 3-C, 4-D
Matching helps you connect principles to meanings quickly.
A school is building a new portal. Any student can see any result. Anyone can change anything.
Questions:
Your family's Wi-Fi router has no password. Anyone can use it.
Questions:
An online shop takes the customer's name and address without checking. It also exposes customer data on errors.
Questions:
These scenarios help you apply what you have learned to real situations.
Group size: 3–5 students
Time: 40 minutes
Materials: Paper, pencil
Instructions:
Goal: To practise applying all six principles together.
Time: 20 minutes
Materials: Notebook, pencil
Instructions:
Goal: To connect principles to your own life.
Time: 1–2 hours
Materials: Paper, pencil, colour pencils
Instructions:
Goal: To practise using all six principles in one design.
Time: 1 week
Materials: Notebook, pencil
Instructions:
Goal: To practise spotting missing principles in real life.
You have finished Module 2. Well done! Here is how to prepare for Module 3, which is all about Thinking About Threats and Building Safely.
TRANSITION TO MODULE 3
======================
[ Module 2: Principles of Secure Design ]
|
V
[ Module 3: Thinking About Threats and Building Safely ]
|
V
[ You will learn: threat models, planning for mistakes,
testing your design, and keeping systems safe ]
See you in Module 3. Keep thinking like a secure designer!
End of Module 2 — Principles of Secure Design
⬅ Back to Course Outline | Go to Module 3 ➡
Security by Design · Beginner Level · 2026
Security by Design · Beginner Level · 2026
Welcome to Module 3 — the final module of Security by Design. You have come a long way. In Module 1, you learned what Security by Design means. In Module 2, you learned the six principles of secure design.
Now we come to the last piece of the puzzle. You will learn how to think about threats before you build. You will learn how to plan for problems. You will learn how to test your design. And you will learn how to keep systems safe after they are built.
Think of a goalkeeper. Before a match, they study the other team. They think about how the other team will attack. They plan how to stop them. A security designer does the same for systems.
In this module, you will learn what a threat model is. You will learn to ask "what could go wrong?". You will learn to plan for mistakes and attacks. You will also learn how to keep systems safe after they are built.
This module is written for complete beginners. You do not need to know any coding. Every new word is explained in very simple language. Every idea comes with examples from real life, school, home, and Nigeria. So relax, read slowly, and let us begin.
YOUR LEARNING JOURNEY IN MODULE 3
=================================
[ Start ]
|
V
What is a Threat Model?
|
V
Asking "What Could Go Wrong?"
|
V
Planning for Mistakes and Attacks
|
V
Testing Your Design
|
V
Keeping Systems Safe After Building
|
V
[ You are ready to build safely! ]
This module teaches you how to think about threats and build safe systems. You will learn about threat models, planning for problems, testing, and keeping systems safe.
By the end of this module, you will be able to:
You will learn to think about threats, plan for problems, test designs, and keep systems safe after they are built.
Ngozi is a 13-year-old girl who lives in Enugu. She loves drama. One day, her teacher asked her to plan the school play.
Ngozi was very excited. She started writing the script immediately.
Her friend Amina came to visit. "Ngozi, have you thought about what could go wrong?" Amina asked.
"What could go wrong?" Ngozi said. "We just act the play!"
Amina smiled. "Let me show you."
She took a piece of paper and wrote:
Ngozi looked at the list. She had not thought about any of these things.
"You are right," Ngozi said. "I need to plan for these problems."
So Ngozi and Amina planned together. They chose a backup actor. They tested the microphone twice. They borrowed a small generator for the lights. They printed more invitations. They measured the stage. They chose an indoor hall in case of rain.
The day of the play arrived. The play was a big success. Nothing went wrong — because they had planned for problems before they happened.
Ngozi learned a big lesson. Thinking about problems first is the secret to success. That is what a threat model is all about.
NGOZI'S PLAN
============
[ Plan the play ]
|
V
[ Ask "what could go wrong?" ]
|
V
[ Plan for each problem ]
|
V
[ The play is a success! ]
Ngozi planned the school play. Her friend Amina taught her to think about problems first. Because they planned, the play was a success. This story introduces the whole module.
In this section, you will go through 12 short lessons. Each lesson teaches one big idea. Each lesson ends with a mini summary. Read slowly. Think about the examples. Ask questions. That is how you learn.
A threat model is a simple plan that lists what could go wrong in a project and how to stop it.
Without a threat model, you are blind to problems. With one, you plan for safety before you build.
Think of planning a trip. You make a list of what could go wrong: rain, traffic, lost luggage. You plan for each one. A threat model is the same.
A bank creates a threat model before opening a new branch.
A school creates a threat model before launching a portal.
Your family creates a simple threat model for a trip.
Nigerian banks create threat models before launching new apps.
THREAT MODEL
============
[ What we're building ]
|
V
[ Who will use it ]
|
V
[ What could go wrong ]
|
V
[ How to prevent it ]
|
V
[ What to do if it happens ]
A threat model is a simple plan that lists what could go wrong and how to stop it.
Asking "what could go wrong?" means thinking of all the problems before they happen.
If you think about problems first, you can plan for them. If you ignore them, they will surprise you.
Think of a picnic. "What could go wrong?" — rain, ants, no food. You plan for each.
A bank asks, "What if someone steals a customer's card?" and plans for it.
A school asks, "What if a student shares their password?" and plans to reset it.
Your family asks, "What if a stranger uses our Wi-Fi?" and sets a password.
A Nigerian bank asks, "What if a fraudster pretends to be a customer?" and uses 2FA.
ASK "WHAT COULD GO WRONG?"
==========================
[ What if someone steals? ]
[ What if someone breaks? ]
[ What if the wrong person sees? ]
[ What if power goes off? ]
|
V
[ Plan for each problem ]
Asking "what could go wrong?" helps you plan for safety before problems happen.
Identifying threats means listing all the dangers that could affect your project.
You cannot protect against a threat you have not noticed.
Think of a hospital. The threats are illness, injury, infection. They list them all.
A bank identifies threats: robbers, hackers, fraudsters, and staff mistakes.
A school identifies threats: cheating students, hackers, and system failures.
Your family identifies threats: thieves, strangers, and accidents.
A Nigerian bank identifies threats: phishing, insider fraud, and system failures.
IDENTIFYING THREATS
===================
[ Attackers ]
[ Mistakes ]
[ Accidents ]
[ Failures ]
[ Insiders ]
|
V
[ Plan for each type ]
Identifying threats means listing all the dangers that could affect your project.
Planning for mistakes means thinking about how users might do something wrong and planning for it.
Mistakes are common. If you plan for them, they do not cause big problems.
Think of a cashier. They might type the wrong amount. You plan for this by asking for confirmation.
A bank asks, "Are you sure you want to send ₦50,000?" before sending money.
A school portal asks, "Are you sure you want to submit?" before final submission.
Your family has a backup key in case someone forgets theirs.
Nigerian banks ask for confirmation before every large transaction.
PLANNING FOR MISTAKES
=====================
[ User makes mistake ]
|
V
[ System asks for confirmation ]
|
V
[ User corrects the mistake ]
|
V
[ No damage done ]
Planning for mistakes means thinking about what users might do wrong and planning for it.
Planning for attacks means thinking about how bad people might attack your system and how to stop them.
Attacks do happen. If you have planned, you can defend your system.
Think of a castle. It has walls, a moat, and guards. Each protects against a different kind of attack.
A bank uses many layers of defence to stop attacks.
A school trains students about fake exam-result messages.
Your family does not click strange links.
Nigerian banks train staff and customers about phishing attacks.
PLANNING FOR ATTACKS
====================
[ Attack comes ]
|
V
[ Many layers of defence ]
|
V
[ Attack blocked ]
|
V
[ System stays safe ]
Planning for attacks means thinking about how bad people might attack and how to stop them.
Building the threat model means putting your threats and plans into a simple document.
A written threat model keeps you organised. You can review and update it.
Think of writing a shopping list. Once it is on paper, you do not forget items.
A bank writes a threat model before launching any new product.
A school writes a threat model before launching a portal.
Your family writes a simple plan for trips and events.
Nigerian banks document their threat models formally.
BUILDING A THREAT MODEL
=======================
[ Describe project ]
|
V
[ List users ]
|
V
[ List problems ]
|
V
[ Plan prevention ]
|
V
[ Plan response ]
|
V
[ Review and update ]
Building a threat model means putting your threats and plans into a simple document.
Testing your design means checking if your plan works before you build.
Testing finds problems before they become real. It saves time, money, and stress.
Think of rehearsing a play. You practice before the real show. Testing is the rehearsal for a design.
A bank tests its new app with a small group before launching to everyone.
A school tests a portal with a few students before opening it to all.
Your family tests the new Wi-Fi password on one device before changing all.
Nigerian banks test new features in a safe environment first.
TESTING YOUR DESIGN
===================
[ Walk through ]
|
V
[ Ask a friend ]
|
V
[ Try to break it ]
|
V
[ Fix problems ]
|
V
[ Ready to build ]
Testing your design means checking if your plan works before you build.
Planning for failures means having a backup plan in case something breaks.
Systems fail. If you have a backup, you can recover quickly.
Think of having a spare tyre in a car. You hope you never need it. But if you do, you are ready.
A bank has backup servers in another city in case of disaster.
A school keeps paper backups of important records.
Your family keeps a spare key outside the house (safely hidden).
Nigerian banks have backup systems and power generators.
PLANNING FOR FAILURES
=====================
[ Main system ]
|
V
[ Something fails ]
|
V
[ Backup ready ]
|
V
[ System recovers ]
Planning for failures means having a backup plan in case something breaks.
Keeping systems safe after building means continuing to protect them after they are launched.
Threats change over time. New attacks appear. You must keep up.
Think of a garden. You do not just plant it. You water it, weed it, and protect it. Systems are the same.
A bank updates its apps every month to fix new threats.
A school reviews its portal every term.
Your family changes the Wi-Fi password every year.
Nigerian banks update their systems constantly to stop new attacks.
KEEPING SYSTEMS SAFE
====================
[ Launch ]
|
V
[ Update regularly ]
|
V
[ Train users ]
|
V
[ Review threat model ]
|
V
[ Stay safe over time ]
Keeping systems safe after building means continuing to protect them after they are launched.
Learning from problems means studying what went wrong and improving your design.
Mistakes teach us. Learning from them makes us stronger.
Think of falling off a bicycle. You learn what caused it. Then you ride better.
When a bank has a breach, it studies what happened and improves security.
When a portal fails, the school finds the cause and fixes it.
When your family's Wi-Fi is hacked, you learn to change the password more often.
Nigerian banks learn from every incident to stay safer.
LEARNING FROM PROBLEMS
======================
[ Problem happens ]
|
V
[ What caused it? ]
|
V
[ How to prevent it? ]
|
V
[ Update the design ]
|
V
[ Better system ]
Learning from problems means studying what went wrong and improving your design.
Teaching others means sharing what you know so everyone stays safe.
When everyone knows the threats, the whole community becomes stronger.
Think of a class. If everyone knows the rules, no one breaks them.
A bank trains all staff about security threats.
A teacher explains phishing to the class.
A parent teaches their child about safe browsing.
Nigerian banks and schools run regular security awareness training.
TEACHING OTHERS
===============
[ You learn ]
|
V
[ You teach family ]
|
V
[ They teach friends ]
|
V
[ Community stays safe ]
Teaching others about threats makes the whole community stronger.
A safe builder is someone who plans, tests, and maintains systems with security in mind.
Safe builders protect their projects and their users. They also teach others.
Think of a careful craftsman. They plan, build, and check their work. A safe builder does the same with systems.
A cybersecurity professional plans, builds, tests, and reviews systems.
A student designs a school project using all the skills.
Your family uses safe habits and reviews them regularly.
Nigerian cybersecurity professionals follow these steps daily.
BECOMING A SAFE BUILDER
=======================
[ Plan ]
|
V
[ Think threats ]
|
V
[ Apply principles ]
|
V
[ Test ]
|
V
[ Keep safe ]
|
V
[ Learn ]
|
V
[ Teach others ]
A safe builder plans, tests, and maintains systems with security in mind. Anyone can become one.
| Word | Simple Definition |
|---|---|
| Threat | Anything that could harm your project. |
| Threat model | A plan listing threats and how to stop them. |
| Attacker | Someone who tries to break your system. |
| Mistake | An error made by a user. |
| Accident | Something that happens by chance. |
| Failure | When something stops working. |
| Insider | Someone inside the system with special access. |
| Backup | An extra copy of data in case the original is lost. |
| Test | Checking if something works. |
| Recovery | Getting back to normal after a failure. |
| Review | Looking at something again to find problems. |
| Safe Builder | Someone who builds systems with security in mind. |
These words are the foundation of threat modelling and safe building. Use them often so they become easy.
Think about what could go wrong before you build. It saves time, money, and stress.
Attackers, mistakes, accidents, failures, and insiders are all threats.
Testing finds problems early. Fixing them is much cheaper than later.
Every system can fail. Plan for recovery.
Systems change. Threats change. Keep learning and teach others.
These five concepts are the heart of Module 3. Read them again before finishing the course.
CREATING A THREAT MODEL
=======================
[ Describe ]
|
V
[ List users ]
|
V
[ List threats ]
|
V
[ Plan prevention ]
|
V
[ Plan response ]
|
V
[ Review ]
TESTING A DESIGN
================
[ Walk through ]
|
V
[ Ask a friend ]
|
V
[ Try to break ]
|
V
[ Fix problems ]
|
V
[ Test again ]
KEEPING SYSTEMS SAFE
====================
[ Launch ]
|
V
[ Update ]
|
V
[ Train users ]
|
V
[ Review ]
|
V
[ Stay safe ]
Creating threat models, testing designs, and keeping systems safe all follow simple steps. Follow them, and your systems stay strong.
A bank creates a threat model before opening a new branch or launching an app.
A hospital plans for power cuts, record losses, and equipment failures.
A school plans for cheating, hacking, and system failures.
An online shop plans for scams, attacks, and payment failures.
A government office plans for hacking, insider threats, and disasters.
Threat modelling and safe building are used in banks, hospitals, schools, shops, and government offices.
Nigerian banks create detailed threat models before launching new products.
Paystack and Flutterwave plan for fraud, outages, and attacks.
Nigerian universities plan for cheating, hacking, and system failures.
NITDA and NCC plan for cyber attacks and national emergencies.
Families plan for theft, fraud, and device loss.
Nigeria uses threat modelling and safe building in banks, fintechs, schools, government, and families.
"What if the cake is late? What if guests do not come?" Plan for each.
"What if it rains? What if someone gets lost?" Plan for each.
"What if a player is injured? What if it rains?" Plan substitutes and indoor options.
"What if the tide comes in?" Build further up the beach.
"What if the player runs out of lives?" Give them a continue option.
Threat modelling appears in parties, trips, matches, sandcastles, and video games.
| Situation | Threat Modelling |
|---|---|
| Planning a trip | What if it rains? |
| Cooking a meal | What if we run out of gas? |
| Going to school | What if the bus breaks down? |
| Setting up Wi-Fi | What if strangers use it? |
| Using a bank app | What if the app fails? |
Even simple daily activities use threat modelling. Now you can see it everywhere.
Parents can teach threat modelling and safe building at home through daily planning and simple examples.
Threat modelling is powerful and used everywhere.
Threat modelling is full of surprises. The more you learn, the safer you become.
These ten points are the heart of Module 3. Read them again before finishing the course.
Avoiding these mistakes will make your systems safer than most.
These ten practices will help you build strong, safe systems.
THREAT MODEL
============
[ What we're building ]
|
V
[ Who will use it ]
|
V
[ What could go wrong ]
|
V
[ How to prevent it ]
|
V
[ What to do if it happens ]
ASK "WHAT COULD GO WRONG?"
==========================
[ What if someone steals? ]
[ What if someone breaks? ]
[ What if the wrong person sees? ]
[ What if power goes off? ]
|
V
[ Plan for each problem ]
IDENTIFYING THREATS
===================
[ Attackers ]
[ Mistakes ]
[ Accidents ]
[ Failures ]
[ Insiders ]
|
V
[ Plan for each type ]
TESTING YOUR DESIGN
===================
[ Walk through ]
|
V
[ Ask a friend ]
|
V
[ Try to break it ]
|
V
[ Fix problems ]
|
V
[ Ready to build ]
KEEPING SYSTEMS SAFE
====================
[ Launch ]
|
V
[ Update regularly ]
|
V
[ Train users ]
|
V
[ Review threat model ]
|
V
[ Stay safe ]
BECOMING A SAFE BUILDER
=======================
[ Plan ]
|
V
[ Think threats ]
|
V
[ Apply principles ]
|
V
[ Test ]
|
V
[ Keep safe ]
|
V
[ Learn ]
|
V
[ Teach others ]
These diagrams help you see threat modelling clearly. Draw them yourself to remember them better.
| Threat | Vulnerability | Risk |
|---|---|---|
| Something that could harm | A weakness | The chance of harm |
| Example: hacker | Example: weak password | Example: account may be hacked |
| Threat | Example |
|---|---|
| Attacker | Hacker, scammer, thief |
| Mistake | Typing wrong password, clicking wrong button |
| Accident | Power cut, flood |
| Failure | Broken server, no internet |
| Insider | Employee or family member misusing access |
| Plan First | Fix Later |
|---|---|
| Cheaper | More expensive |
| Faster | Slower |
| Safer | Riskier |
| Keeps trust | Loses trust |
Comparing ideas side by side helps you remember the differences clearly.
| Lesson | Main Idea |
|---|---|
| Lesson 1 | A threat model lists threats and prevention plans. |
| Lesson 2 | Always ask "what could go wrong?". |
| Lesson 3 | Identify all threats: attackers, mistakes, accidents. |
| Lesson 4 | Plan for mistakes by confirming actions. |
| Lesson 5 | Plan for attacks with many layers. |
| Lesson 6 | Write your threat model down. |
| Lesson 7 | Test your design before building. |
| Lesson 8 | Always have a backup plan. |
| Lesson 9 | Keep systems safe after building. |
| Lesson 10 | Learn from problems to improve. |
| Lesson 11 | Teach others about threats. |
| Lesson 12 | Anyone can become a safe builder. |
Congratulations! You have completed Module 3. Let us review what you have learned.
You began by learning what a threat model is — a simple plan that lists what could go wrong and how to stop it.
You learned to always ask "what could go wrong?".
You discovered how to identify threats — attackers, mistakes, accidents, failures, and insiders.
You explored planning for mistakes by confirming actions.
You learned how to plan for attacks with many layers of defence.
You discovered how to build a threat model step by step.
You learned how to test your design before building.
You explored planning for failures with backups and recovery plans.
You learned how to keep systems safe after building.
You discovered how to learn from problems.
You learned how to teach others about threats.
Finally, you learned how to become a safe builder.
MODULE 3 SUMMARY MAP
====================
[ Threat Model ]
|
V
[ Ask "What Could Go Wrong?" ] -> [ Identify Threats ]
|
V
[ Plan for Mistakes ] -> [ Plan for Attacks ]
|
V
[ Build the Model ] -> [ Test the Design ]
|
V
[ Plan for Failures ] -> [ Keep Safe After Building ]
|
V
[ Learn from Problems ] -> [ Teach Others ] -> [ Safe Builder! ]
Well done! You have completed the entire Security by Design course. You now have strong skills to plan, build, and maintain safe systems.
A threat model is a simple plan that lists what could go wrong in a project and how to stop it.
Because thinking about problems first saves time, money, and stress.
"What could go wrong?"
Attackers, mistakes, accidents, failures, and insiders.
Ask for confirmation before important actions. Show clear warnings. Allow undo.
Use many layers of defence: strong passwords, 2FA, antivirus, and training.
Walk through it step by step. Ask a friend to review it. Try to break it yourself.
Having a backup plan in case something breaks.
Continuing to update, train, and review your system after it is launched.
How to think about threats, plan for problems, test designs, and keep systems safe.
| Column A (Word) | Column B (Meaning) |
|---|---|
| 1. Threat model | A. Something that could harm |
| 2. Threat | B. A plan listing threats |
| 3. Backup | C. An error made by a user |
| 4. Mistake | D. Getting back to normal after a failure |
| 5. Recovery | E. An extra copy of data |
Answers: 1-B, 2-A, 3-E, 4-C, 5-D
| Column A (Threat) | Column B (Example) |
|---|---|
| 1. Attacker | A. Typing wrong password |
| 2. Mistake | B. Hacker |
| 3. Accident | C. Staff misusing access |
| 4. Failure | D. Power cut |
| 5. Insider | E. Broken server |
Answers: 1-B, 2-A, 3-D, 4-E, 5-C
Matching helps you connect words to meanings quickly.
A school is launching a new portal next week. The developers have not created a threat model.
Questions:
Your family just set up Wi-Fi but did not plan for problems.
Questions:
A trader is opening an online shop. She has not thought about attacks or failures.
Questions:
These scenarios help you apply what you have learned to real situations.
Group size: 3–5 students
Time: 40 minutes
Materials: Paper, pencil
Instructions:
Goal: To practise creating a threat model as a team.
Time: 20 minutes
Materials: Notebook, pencil
Instructions:
Goal: To apply threat modelling to your own life.
Time: 1–2 hours
Materials: Paper, pencil, colour pencils
Instructions:
Goal: To practise creating a full threat model.
Time: 1 week
Materials: Notebook, pencil
Instructions:
Goal: To see threat modelling in real systems.
You have completed the entire Security by Design course. Well done! Here is what to do next.
YOUR COURSE JOURNEY
===================
[ Module 1: What is Security by Design? ]
|
V
[ Module 2: Principles of Secure Design ]
|
V
[ Module 3: Thinking About Threats and Building Safely ]
|
V
[ You are now a secure designer and safe builder! ] 🎉
Congratulations on completing the course. Keep thinking like a secure designer and a safe builder. The world needs people like you.
End of Module 3 — Thinking About Threats and Building Safely
End of the Security by Design Course
⬅ Back to Course Outline | ⬅ Back to Module 2
Security by Design · Beginner Level · 2026