Create a mapping of Secure by Design requirements

[mitchelbaker-cisa]

Is your feature request related to a problem? Please describe.

Create a mapping of Secure by Design requirements and how these relate to new features planned for LME 2.0.

Describe the solution you'd like

Secure by Design principles:

• [x] Memory safe programming languages (Go, Python, Podman and memory safe containers?)
• [ ] Secure Hardware Foundation
• [ ] Secure Software Components
• [ ] Web template frameworks (N/A) (does elastic have preventative measures against XSS)
• [ ] Parameterized queries
• [ ] Static and dynamic application security testing (SAST/DAST)
• [x] Code review
• [ ] Software Bill of Materials (SBOM)
• [ ] Vulnerability disclosure programs
• [ ] CVE completeness
• [ ] Defense-in-depth
• [ ] Satisfy Cybersecurity Performance Goals (CPGs)

Secure by Default principles:

• [ ] Eliminate default passwords
• [ ] Mandate MFA
• [ ] SSO
• [ ] Secure logging
• [ ] Software authorizatino profile
• [ ] forward-looking security over backwards compatibility
• [ ] track/reduce "hardening guide" size
• [ ] Consider user experience consequences of security settings

Additional context

Secure by Design pdf