(Orange International Pvt. Ltd. is an IT company that develops software products and web applications for Android phones. The organization recognizes…

The principle of "Secure by Design" means that security is an integral part of the system's architecture from the very beginning, rather than an afterthought. The practices described—establishing robust access management, implementing defense-in-depth, avoiding custom cryptographic solutions ("avoided reinventing the wheel"), and securing the software supply chain ("reduced third-party involvement")—are all high-level, foundational architectural decisions. These actions embed security into the core structure and logic of the application, which is the essence of designing a system to be secure from the ground up.

A. Secure by implementation focuses on the specific, low-level coding practices used to build the components, not the overarching architectural strategy.

B. Secure by default relates to ensuring a system's initial, out-of-the-box configuration is the most secure one, which is only one aspect of a secure design.

D. Secure by communication is not a standard, comprehensive security principle; it typically refers to the specific practice of securing data in transit (e.g., using TLS).

- Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278–1308. This foundational academic paper outlines key security design principles, such as defense-in-depth (fail-safe defaults, complete mediation), which are central to the Secure by Design concept. (https://doi.org/10.1109/PROC.1975.9939)

- NIST Special Publication (SP) 800-218, Secure Software Development Framework (SSDF) Version 1.1. (February 2022). Section 2, "The SSDF," outlines practices under "Prepare the Organization (PO)" and "Protect Software (PS)" that directly map to Secure by Design principles, such as defining security requirements and designing software to meet them.