2.5.4 doesn't relate to credential recovery

[tghosth]

We have spoken about this requirement before but bottom line is that this doesn't seem to belong in "Credential Recovery"

#	Description	L1	L2	L3	CWE
2.5.4	[MODIFIED] Verify that default user accounts (e.g. "root", "admin", or "sa") are not present in the application or are disabled.	✓	✓	✓	798

I think we have a few potential target locations:

• Option 1 - V2.2 General Authentication Security - This doesn't really fit anywhere else in V2 otherwise.
• Option 2 - V14.6 Web or Application Server Configuration - This could be considered configuration as it is not necessarily something that is coded into the application but I think this is a weaker choice

What do people think? @elarlang

[elarlang]

V2 is "do authentication correctly". If default credentials are used, from V2 perspective it is handled correctly.

For me it is a V14 issue.

Not a perfect match, but V14.1 deploy is dealing with "do not put test-code", "debug modes", "demo functionality" etc to the production. But this is just the first idea, does not give "let's go for the PR" feeling.

[tghosth]

@jmanico @ryarmst @randomstuff any thoughts on this?

[jmanico]

This is more user policy than general authN so I agree v14 seems better.

[randomstuff]

I do not find it shocking to find it in V2. V14 is probably OK as well.

[ryarmst]

V14 seems like a fine fit.

[tghosth]

V14.1 gives me the best vibes here, opened PR #2403