...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Our application expects (any) client to upload models and data to be stored. These models and data are validated via the 3rd party tool - OpenDayLight Yang parser which is part of CPS and not a separate microservice. These are only stored once the parser accepts that it is valid and returns an exception for invalid models and data. Additionally, inputs to all REST endpoints are validated, e.g. CM handle IDs, CPS paths, timestamps | Is the ODL Yang parser included in CPS or is it a separate "microservice"? How does CPS differentiate between trusted and untrusted sources? |
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS does not have a UI and does not use javascript The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation. . Usernames and passwords are configured in .yml file of CPS for clients to configure. When CPS is run with docker, the services use username and passwords that are stored as environment variables. | How are usernames and passwords stored? Are passwords stored hashed where CPS acts as an authenticator? |
...