1.2.2 "User Account" is troubling

[jmanico]

I suggest we change "user accounts" to "service accounts" based on the context of this requirement.

#	Description	L1	L2	L3	CWE
1.2.2	[MODIFIED] Verify that communications between back-end application components, including APIs, middleware and data layers, are authenticated and use individual user accounts. (C3)		✓	✓	306

[elarlang]

As it is implementation requirement, it should be moved away from V1 category.

[elarlang]

But what exact attack scenario or weakness does the requirement address?

Not all services require authentication.

What is accepted authentication? Basic auth vs some application logic for auth vs certificate...

ping @tghosth

[tghosth]

We have a separate and similar discussion going on about this in #1032, I am going to move the comments there and close this for now.