"The project MUST have performed a security review within the last 5 years. This review MUST consider the security requirements and security boundary." – Best Practices Badging Criteria [security-review G]
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| Yes. Majority of DCAE committers and PTL are generally familiar with secure software development practice and experienced in vulnerability resolution. The CLM scan reports and OJSI tickets are periodically assessed by the same PTL/committers. |
Implement Secure Design
Do the committers and PTL apply secure design principles when reviewing software for merging?
...
| Your Answer-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| Yes, DCAE PTL/committers do review for security design principles adhrence adherence before merging code. |
Know Common Errors
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| PTL/most committers do understand and make effort to mitigate these errors during reviews. A session on security/quality checkpoints will be organized for London to get all new committers up to speed. |
...
| Your Answer-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| Yes, all DCAE patches are verified to ensure non-test credentials/private keys are not included in the code/repositories |
...
| Your Answer-Please Describe | ScoreFeedback / Recommendations |
|---|---|
| Yes. DCAE architecture is maintained under ONAP RTD - https://docs.onap.org/projects/onap-dcaegen2/en/latest/sections/architecture.html |
...
| Your Answer-Please Describe | ScoreFeedback / Recommendations |
|---|---|
| Yes. Documented under this wiki DCAE Security Design & Assurance |
Assurance Case
Does your project actually meet its documented security requirements?
...
| Your Answer-Please Describe | ScoreFeedback / Recommendations |
|---|---|
| Yes. Documented under this wiki DCAE Security Design & Assurance |
Vulnerability Mitigation
Vulnerabilities Critical Fixed
...
| Your Answer-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| Mostly YES. Majority of the projects have no/minimal vulnerabities and blocker issues reported from SONARCLOUD for DCAE components - https://sonarcloud.io/organizations/onap/projects?search=dcaegen2&sort=-coverage |
...
| Your Answer-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| Yes. Critical vulnerabilities/issues are compiled by SECCOM periodically and DCAE project team resolves them in-time for current/prev release. |
...
| Your Answer-Please Explain | ScoreFeedback / Recommendations |
|---|---|
DCAE has different types of components/microservices Collectors: All DCAE collectors interface with external network element (trusted/untrusted depending on protocol/interface) however data validation is done in most cases. VESCollector/HV-VES - Data validation done on event receipt and rejected if non-conforming to the expected spec. Both collectors are expected to recieve data from any xNF.
EventProcessors/Analytics - These components do not accept data from external sources (i.e outside ONAP) and work through data coming via DMAAP (internal to ONAP) |
...
| Your Answer-Please Explain | ScoreFeedback / Recommendations |
|---|---|
Majority of DCAE services are complaint. There are no C/C++ code in DCAE repositories hence compiler flags related questions do not apply. DL-Admin has a web (user) interface which is not complaint with all hardening requirements listed; it also stores external DB credentials (TBD if data is encrypedencrypted/hashed when persisted in DB). |
...
| Your Answer-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| DCAE does not include any internal module to implement cryptography - strictly uses AAF (currently) and OOM/ServiceMesh for supporting them. |
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| DCAE does not generate any cryptographic keys and/or nonces. Need to ensure DL-Admin updates planned are compliant with this requirement in future release. |
...
| Your Answer-Please Explain | ScoreFeedback / Recommendations |
|---|---|
No such known dependency exist currently. Need to ensure DL-Admin updates planned are compliant with this requirement in future release. |
...
| Your Answer-Please Explain | ScoreFeedback / Recommendations |
|---|---|
No such known dependency exist currently. Need to ensure DL-Admin updates planned are compliant with this requirement in future release. |
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| DCAE does not generate keys |
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
Not currently however need to ensure DL-Admin updates planned are compliant with this requirement in future release. |
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
As of Kohn, DCAE component default deployment is set for non-TLS (in OOM charts) however the ServiceMesh integration will ensure both inter and intra ONAP component communication is supported under TLS. To be confirmed if host certificate validation is done under Service Mesh. |
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
In general the application credentials are stored as K8S secret and application config under K8S Configmap. For application config processing simplification, these are combined into single file within K8S pod/container (true when credentials are maintained part of microservice charts). With migration to SVC mesh, most component charts are being updated to remove independent K8S secret in Kohn, any remaining updates will be completed by London release. |
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| Yes, all DCAE component support mininum TLSv1.2 (when enabled for HTTPS) |
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
Yes, most DCAE components (collectors) support secure external interfaces with exception of SNMPTRap which is based on UDP protocol. FTP (DFC), HTTP (VES) are supported options but disabled by default. |
...
| Your Answers-Please Explain | ScoreFeedback / Recommendations |
|---|---|
| All DCAE components uses standard libraries for HTTPS calls (java components use java11 libraries and python components uses request library). These lib's are externally managed and we believe these requirements for certificate verification before sending HTTP headers are being met. |
...