Versions Compared

Old Version 2

changes.mady.by.user Paweł Pawlak

Saved on

compared with

New Version 3

changes.mady.by.user Paweł Pawlak

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Slides prepared and reviewed by Amy:

Common logs management turned into PoC.

Jira No
SummaryDescriptionStatusSolutionHonolulu SECCOM requirements

ongoingTo be presented at the LFN event within Requirements Subcommitee review.LFN event

2 presentations provided:

  • packages upgrades (Amy, Vijay and  Pawel)
  • CII Badging (Tony)

Anuket project – Samuli – security tools for CNF.

done

Slides on SECCOM requirements to be presented at the next Requirements Subcommittee meeting on Monday February 15th. 

POM file version to be provided to PTLs.

Exception process with deadline before RC0.


ONAP Log security management

Fabian shared his presentation:

View file
nameONAP Logs Security Managment1.pptx
height150

2 types of basic image hardening. It was done by Morgan.

PoCs with SPC (brand news project) and Policy (project which already took efforts to integrate with logging) proposed to move forward.

ongoing

Next steps 

Deploy logging architecture

Analyze events linked to threats


Instambul SECCOM requirements
  • Packages upgrades
  • CII Badging - crypto verification private and implement secure design
  • PoC Security documentation and assurance cases:with DCAE and CPS
  • Integrate SonarCloud crypto findings as an integration test
  • Integrate SonarCloud coverage results as integration test: block on decreases in code coverage, provide exception process
  • PoC Service Mesh
ongoingSlide to be updated and shared with Alla.

Service Mesh PoC status updateNew release of Kubernetes to be integrated. Some issue with Envoy.


Sonarcloud crypto takeaways

Weak crypto report from Sonarcloud. Jiras to be opened. How to get a report with API to be figured out. 5 cathegories of findings: certificate validation, host name of certificate, using secure mode and padding, using weak protocols, encoding passwords as plain text.  




Logs management – what to do next?

We come back to this topic during next meeting (in February 9th)




OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 16th OF FEBRUARY'21. 




...