...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| Yes, the majority of the CPS team & PTL are aware of security best practices and are experienced in mitigation and vulnerability resolution. | +1 |
Implement Secure Design
Do the committers and PTL apply secure design principles when reviewing software for merging?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| Yes CPS team/PTL/committers review and look for security issues and recommend fixes before merging. | +1 |
Know Common Errors
Do the committers and PTL understand commonly found errors (and how to counter or mitigate them)? Do they apply these principles when reviewing software for merging?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| Yes, the CPS team & PTL are aware of common security risks and how to mitigate them. There are also security checks in our CI pipeline | +1 |
No Leaked Credentials
Do the committers and PTL verify that there are no non-test credentials and no non-test private keys in code to be merged?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
We do have clear text default credentials in our docker-compose files if not provided (Only used for testing). The users of CPS are expected to override credentials and strategies around these. | +1 |
Security Documentation
Documentation Architecture
...
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
| Yes, CPS architecture documentation can be found @ https://docs.onap.org/projects/onap-cps/en/latest/architecture.html | Note: Architecture diagram is for the Istanbul release. Please update "This page reflects the state for Istanbul-R9 release" to reflect the current release. |
Documentation Security
Does your project have a description of what a user of your project can and cannot expect in terms of security from the software produced by the project, (In other words, what are its 'security requirements'?)
...
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
None available CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable | [TH] Please Please add a statement about this to the end of your architecture document (or in another wiki page), with a heading such as "CPS Security Requirements." |
...
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
None available CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable | [TH] Please add a statement about this to the end of your security requirements section/document. At a minimum, it should indicate how you protect your username and password configurations. (See other questions on hashing of secrets and use of crypto.) |
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Yes, CPS sonarcloud reports can be found @ https://sonarcloud.io/organizations/onap/projects?search=cps&sort=-coverage https://sonarcloud.io/organizations/onap/projects?search=ncmp-dmi-plugin&sort=-coverage | +1 |
Vulnerabilities Fixed 60 Days
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Yes. Critical vulnerabilities/issues are compiled by SECCOM periodically and CPS project team resolves them in-time for current/prev release. We also check sonarcloud reports on a weekly basis and if needed action is taken. | +1 |
Non-Cryptographic Software Questions
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Our application expects (any) client to upload models and data to be stored. These models and data are validated via OpenDayLight Yang parser. These are only stored once the parser accepts that it is valid and returns an exception for invalid models and data. Additionally, inputs to all REST endpoints are validated, e.g. CM handle IDs, CPS paths, timestamps | Is the ODL Yang parser included in CPS or is it a separate "microservice"? How does CPS differentiate between trusted and untrusted sources? |
Hardening
Does your project apply hardening mechanisms so that software defects are less likely to result in security vulnerabilities?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS does not have a UI and does not use javascript The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation. | [TH] You should mention use of HTTPS behind mesh.How are usernames and passwords stored? Are passwords stored hashed where CPS acts as an authenticator? |
Cryptographic-specific Software Questions
...