Do we need X-Pack to enable security in Elasticsearch and kibana?
X-Pack is the name of the module that contains the security code.
For Elasticsearch versions prior to 6.3, X-Pack had to be installed separately as a plugin. Some X-Pack features were free to use (Basic license), some required a commercial license (e.g. Security). Starting with 6.3 the default download contains that X-Pack module already. X-Pack as a product and plugin do no longer exist.
Starting with Elasticsearch version 6.8/7.1 Elastic moved some basic security features from the commercial license into the free Basic tier, only requiring you to configure it.
The parameters for doing so are still prefixed with "xpack", as it is still a setting of an spect from within this module.