{
  "uid": "cogitave.learn.secure-sdlc.the-security-baseline",
  "kind": "moduleUnit",
  "href": "/modules/secure-sdlc/the-security-baseline/",
  "title": "The security baseline",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "Secure-by-design and secure-by-default",
    "Identity and access management",
    "Secrets, PKI, and threat modeling",
    "The controls are enforced in-repo"
  ],
  "source": "The baseline is the set of controls every Cogitave product is built on. The\n[Security Standard](../../../../standards/docs/standards/security.md) owns them;\nthis unit teaches you to recognize each one and where it lives.\n\n## Secure-by-design and secure-by-default\n\nTwo principles are **required** of every product and service, mapped to the CISA\nSecure-by-Design pledge in the\n[Secure Development Lifecycle Standard](../../../../standards/docs/standards/secure-development-lifecycle.md):\n\n- **Secure-by-design.** Threat modeling happens at the architecture phase, not\n  after code exists. Design for **least privilege**, **defense-in-depth**, and\n  **zero trust** - every boundary authenticates and authorizes - and **fail\n  secure** (deny on error). No backdoors, no hardcoded credentials.\n- **Secure-by-default.** The out-of-box configuration is the safe one:\n  deny-by-default network posture, encryption in transit and at rest on,\n  debug and verbose-error surfaces off, audit logging on. A user must take a\n  deliberate, recorded action to become **less** safe, never to become safe.\n\n## Identity and access management\n\nIAM is scoped to three kinds of principal, each least-privilege:\n\n- **Human.** SSO/SAML with SCIM provisioning and deprovisioning, RBAC, and prompt\n  deprovisioning.\n- **Workload.** No static keys - **OIDC** (for example GitHub Actions to cloud),\n  moving later to SPIFFE/SVID workload identity.\n- **Agent.** Agent identity and authority are **first-class**: an agent acts under\n  its own identity and an explicit capability and sandbox grant, never an ambient\n  or borrowed one.\n\n## Secrets, PKI, and threat modeling\n\nSecret management is **centralized** - no secrets in repos or folders - and key\nlifecycle (SSH commit-signing keys, release-signing keys, rotation policy)\nproduces non-repudiation evidence. **Threat modeling** is a named control done\nper feature or system, STRIDE-style, with a dedicated threat model for the Yuva\nagent OS. Vulnerability management runs Dependabot, secret scanning, and code\nscanning (CodeQL) with remediation SLAs, and an incident-response plan covers\nroles, severity, and postmortem.\n\n## The controls are enforced in-repo\n\nThe baseline is not advisory. It is enforced by controls that live in the\nrepository itself: **CODEOWNERS** for separation of duties, a branch **ruleset**,\n**gitleaks**, **signed commits**, secret **push protection**, a least-privilege\n`GITHUB_TOKEN`, and an allowed-actions allowlist.\n\n> [!NOTE]\n> The Security Standard owns these controls; it does **not** own the process that\n> applies them stage by stage. That is the next unit - the secure development\n> lifecycle - which references these controls rather than restating them.\n",
  "partOf": "cogitave.learn.secure-sdlc",
  "durationInMinutes": 7,
  "quiz": null
}