CD-SEC-05 - Authentication and Secure Communication Failures
Functionality-first defaults lead to disabled TLS validation, HTTP instead of HTTPS, hardcoded bearer tokens, and missing MFA.
Intent & Description
'
🎯 Intent
Prevent functionality-first defaults that compromise authentication and secure communication.
📋 Context
Functionality-first defaults lead to disabled TLS validation, HTTP instead of HTTPS, hardcoded bearer tokens, and missing MFA — because the citizen developer’s goal is “make the connection work,” and disabling a security check is often the fastest way to clear an error.
💡 Solution
Restrict new production connections to authorized personnel. Implement platform-level scanning for non-compliant connections. Create pre-built “secure connection” templates so the easy path and the secure path are the same path. Enforce TLS and block HTTP-only endpoints at the platform/network layer. Require MFA for sensitive connections.'
Real-world Use Case
Source
📌 TL;DR
Enforce secure authentication and communication. Use secure templates, scan for non-compliant connections, enforce TLS, and require MFA.
Advantages
- Ensures secure communications
- Prevents hardcoded credentials
- Enforces security best practices
- Reduces misconfiguration risk
Disadvantages
- May require platform changes
- Template maintenance overhead
- Could slow development initially