"The project MUST have performed a security review within the last 5 years. This review MUST consider the security requirements and security boundary." – Best Practices Badging Criterion
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
No Usernames and passwords are configured in .yml file of CPS for clients to configure. When CPS is run with docker, the services use username and passwords that are stored as environment variables. | [TH] how about storage of usernames & passwords? |
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS has not switched to HTTPS but the plan is to switch to enabling service mesh which should take care of HTTPS/TLS encapsulation.There has been a POC created as part of this plan. ** Currently, CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. CPS service port names has been changed to include http in name |
Crypto Credential Agility
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS does not store or save authentication credentials, the only information saved by CPS is data and models either via client's input or initial input from the application start up. Usernames and passwords are configured in .yml file of CPS for clients to configure. When CPS is run with docker, the services use username and passwords that are stored as environment variables. | [TH] how about storage of usernames and passwords for REST access? |
...