Create a mapping of Secure by Design requirements

[mitchelbaker-cisa]

Is your feature request related to a problem? Please describe.

Create a mapping of Secure by Design requirements and how these relate to new features planned for LME 2.0.

Describe the solution you'd like

Secure by Design principles:

• Memory safe programming languages (Go, Python, Podman and memory safe containers?)
• Secure Hardware Foundation
• Secure Software Components
• Web template frameworks (N/A) (does elastic have preventative measures against XSS)
• Parameterized queries
• Static and dynamic application security testing (SAST/DAST)
• Code review
• Software Bill of Materials (SBOM)
• Vulnerability disclosure programs
• CVE completeness
• Defense-in-depth
• Satisfy Cybersecurity Performance Goals (CPGs)

Secure by Default principles:

• Eliminate default passwords
• Mandate MFA
• SSO
• Secure logging
• Software authorizatino profile
• forward-looking security over backwards compatibility
• track/reduce "hardening guide" size
• Consider user experience consequences of security settings

Additional context

Secure by Design pdf