Which design principle states that a user has no access by default to any resource, and unless a resource is explicitly granted, it should be denied?

The principle of fail-safe defaults, also known as "default deny," dictates that the default access setting for any resource is no access. Access must be explicitly and intentionally granted. This approach ensures that in the case of an oversight or failure in the access control configuration, the system defaults to a secure state (denial of access) rather than an insecure one (granting of access). This directly matches the scenario where a user has no access by default and must be explicitly granted permissions.

A. economy of mechanism: This principle advocates for keeping security designs as simple and small as possible to facilitate verification and reduce the chance of errors.
C. complete mediation: This principle requires that every access attempt to any object must be validated against an access control mechanism, preventing cached or bypassed permissions.
D. least privilege: This principle states that a user or process should only be granted the minimum permissions necessary to perform its required functions.

1. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 17(7), 38-49. In Section I.A.3, "Design Principles," Principle 2, "Fail-safe defaults," is defined as: "Base access decisions on permission rather than exclusion. This principle means that the default situation is lack of access, and the protection scheme identifies conditions under which access is permitted." (Page 40).

2. National Institute of Standards and Technology (NIST). (2018). Special Publication (SP) 800-160, Vol. 1: Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems. In Appendix F, "Security Design Principles," the principle of "Default to safe/secure states (e.g., fail-safe, fail-secure, fail-closed)" is described as ensuring that in the absence of explicit permission, access is denied. (Page F-3).

3. Bishop, M. (2003). Computer Security: Art and Science. Addison-Wesley Professional. In Chapter 1, "Introduction," Section 1.3.2, "Fundamental Principles," the principle of Fail-Safe Defaults is explained as the default action being to deny permission. (Page 13).