...
| Wiki Markup |
|---|
Software components often contain multiple subcomponents that act as subsystems, where each component operates in one or more trusted domains. For example, one component may have access to the file system but lack access to the network, while another component has access to the network but lacks access to the file system. _Distrustful decomposition_ and _privilege separation_ \[[Dougherty 2009|AA. Bibliography#Dougherty 2009]\]] are examples of secure design patterns that recommend reducing the amount of code that runs with special privileges by designing the system using mutually untrusting subcomponents. |
...
Data received by a component from a source outside the component's trust boundary may , in fact, be malicious. The Consequently, the program must therefore take steps to ensure that the data are both genuine and appropriate.
...