Page Comparison

SECCOM requirements were presented on 26th of  October. 

• Continue packages upgrades in direct dependencies (REQ-439)
• Continue Java (REQ-438) and Python migrations (REQ-437)
• After Service Mesh PoC - new requirements might arrive.
• Harbor requirement. In Harbor:
  • you can sign the image and you can share the key with an application that has an account to pull or to push the image
  • possibility to scan the image all the time and send warning
  • Harbor deployed in run time while Whitesource and Nexus-IQ during the development.
• Logs management:
  • common place for data - all applications should generate logs that can be collected by Kubernetes (target for next release) – Honolulu requirement (REQ-441)
  • common format for data - format of minimum data that we want that is useful (target for Istambul release)
• SIEM integration (REQ-464):
  • integration like for the other applications with SIEM, have the same protocol used
  • logs from ONAP to SIEM, falco tool to be considered (IDS for Kubernetes)
  • alarms when security issue
• CII Badging: (REQ-443), Focus on Application Security questions:
  • Crypto Credentials Agility – ½ od apps in met and almost half not yet answered
  • Implement Secure Design – 1/3 of projects did not answer
  • Crypto Weaknesses – tests to be applied (3 including Morgan)
• HELMv3 migration (REQ-442)

Prioritization will be done by TSC.

With Fabian we made a SIEM requirement.  

CLAMP for flows documentation provided by Pierre.

Requirements for Harbor to be provided to Jessica and use Jenkins sandbox.

Internal meetings to be organized by Fabian with his team and come back to SECCOM with 2 features utilization idea:

• use of Trivi to san the images
• sign the image with Notary

Script must be written to collect requested information on secrets used.

Looking at CII Badging answers in this area.

ONAP security requirements was also covering this area (master keys).

Krzysztof to be contacted as Samsung team worked on this topic in the past.

Amy to check Sonatype outputs in this area.

Discussion point: Natacha initiated Wiki page: 

Flow matrix guidelines UNDER CONSTRUCTION 

1. Packages upgrades progress 
2. Java (v8 → 11) and Python (v2.7 → v3.6) migrations
3. Progress in packages not running as root - decrease
4. Migrations to https as dafault best practice

Problem statement:

It does not answer the question whether projects are using now only Python 3 and Java 11. In multiple cases people are using custom images and simply did not remove Python 2 and Java 8 as not used.

Standard image does not have old versions in it, we shall push projects to use standard image for Honolulu release and if from some reason they need to run custom image, they must remove what they do not use.

Amy had exchanges with Pawel W. 

Scripts updates are needed.

Base images would not use

Wiki to be used for results posting - David to be contacted by Amy.

E-mail to be sent to onap-discuss on that by Amy.  

SECCOM requirement provided after the deadline (16th of October):  

• SIEM integration (REQ-464):
  • integration like for the other applications with SIEM, have the same protocol used
  • logs from ONAP to SIEM, falco tool to be considered (IDS for Kubernetes)
  • alarms when security issue

Prioritization will be done by TSC.

With Fabian we made a SIEM requirement.  

To be added as it is mature:

Implementation is done to identify events that compromise the system.

This information feedback is done because only an intervention can stop this risk.

The events are logged and according to rules have intervened according to the risks.

External system must be use to save and display the log

Secure protocol  must be use to transfert the log between ONAP and external system

Secrets management by NatachaHarbor discussion.