Versions Compared

Old Version 19

changes.mady.by.user Lee Anjella Macabuhay

Saved on

compared with

New Version 20

changes.mady.by.user Lee Anjella Macabuhay

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

"The project MUST have performed a security review within the last 5 years. This review MUST consider the security requirements and security boundary." – Best Practices Badging Criterion

...

Your Answer-Please DescribeSECCOM Feedback / Recommendations
Yes, CPS architecture documentation can be found @ https://docs.onap.org/projects/onap-cps/en/latest/architecture.html 

Note: Architecture diagram is for the Istanbul release.

Please update "This page reflects the state for Istanbul-R9 release" to reflect the current release.

Documentation Security

Does your project have a description of what a user of your project can and cannot expect in terms of security from the software produced by the project, (In other words, what are its 'security requirements'?)

...

Your Answer-Please DescribeSECCOM Feedback / Recommendations

None available

CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable



Please add a statement about this to the end of your security requirements section/document. At a minimum, it should indicate how you protect your username and password configurations. (See other questions on hashing of secrets and use of crypto.)


comment on

-logging requirements

-encryption in transit (service mesh compatibility)

-not running containers as 'root'

Vulnerability Mitigation

Vulnerabilities Critical Fixed

...

Cloak

The project results MUST check all inputs from potentially untrusted sources to ensure they are valid (an *allowlist*), and reject invalid inputs, if there are any restrictions on the data at all.
Note that comparing input against a list of 'bad formats' (aka a *denylist*) is normally not enough, because attackers can often work around a denylist. In particular, numbers are converted into internal formats and then checked if they are between their minimum and maximum (inclusive), and text strings are checked to ensure that they are valid text patterns (e.g., valid UTF-8, length, syntax, etc.). Some data may need to be 'anything at all' (e.g., a file uploader), but these would typically be rare.

[input_validation S]


Your Answer-Please ExplainSECCOM Feedback / Recommendations

Our application expects (any) client to upload models and data to be stored.

These models and data are validated via the 3rd party tool - OpenDayLight Yang parser which is part of CPS and not a separate microservice. These are only stored once the parser accepts that it is valid and returns an exception for invalid models and data.

Additionally, inputs to all REST endpoints are validated, e.g. CM handle IDs, CPS paths, timestamps

Is the ODL Yang parser included in CPS or is it a separate "microservice"?

How does CPS differentiate between trusted and untrusted sources?



Hardening

Does your project apply hardening mechanisms so that software defects are less likely to result in security vulnerabilities?

...

How are usernames and passwords stored?

Are
Your Answer-Please ExplainSECCOM Feedback / Recommendations

CPS does not have a UI and does not use javascript

The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation.


Usernames and passwords are configured in .yml file of CPS for clients to configure.

When CPS is run with docker, the services use username and passwords that are stored as environment variables.

Testing: credentials are hardcoded

Deployment: uses K8s secrets that is generated and stored as CPS is deployed

How are usernames and passwords stored?

Are passwords stored hashed where CPS acts as an authenticator?


...

Your Answer-Please ExplainSECCOM Feedback / Recommendations

N/A

[TH] how about storage of passwords?

Crypto Working

Does your software depend on any cryptographic algorithms that are known to be broken?

...


Usernames and passwords are configured in .yml file of CPS for clients to configure.

When CPS is run with docker, the services use username and passwords that are stored as environment variables.

Testing: credentials are hardcoded

Deployment: uses K8s secrets that is generated and stored as CPS is deployed


CPS relies on the java.UUID mechanism **

[TH] how about storage of passwords?

Crypto Working

Does your software depend on any cryptographic algorithms that are known to be broken?

toggle-cloak
 Cloak
The default security mechanisms within the software produced by the project MUST NOT depend on broken cryptographic algorithms (e.g., MD4, MD5, single DES, RC4, Dual_EC_DRBG), or use cipher modes that are inappropriate to the context, unless they are necessary to implement an interoperable protocol (where the protocol implemented is the most recent version of that standard broadly supported by the network ecosystem, that ecosystem requires the use of such an algorithm or mode, and that ecosystem does not offer any more secure alternative). The documentation MUST describe any relevant security risks and any known mitigations if these broken algorithms or modes are necessary for an interoperable protocol.
ECB mode is almost never appropriate because it reveals identical blocks within the ciphertext as demonstrated by the ECB Penguin, and CTR mode is often inappropriate because it does not perform authentication and causes duplicates if the input state is repeated. In many cases it's best to choose a block cipher algorithm mode designed to combine secrecy and authentication, e.g., Galois/Counter Mode (GCM) and EAX. Projects MAY allow users to enable broken mechanisms (e.g., during configuration) where necessary for compatibility, but then users know they're doing it.
[crypto_working P]
...
[TH
Your Answer-Please ExplainSECCOM Feedback / Recommendations
No

Usernames and passwords are configured in .yml file of CPS for clients to configure.
When CPS is run with docker, the services use username and passwords that are stored as environment variables.
Testing: credentials are hardcoded
Deployment: uses K8s secrets that is generated and stored as CPS is deployed

CPS relies on the java.UUID mechanism **
[TH] how about storage of usernames & passwords?
...
This does not apply 
Your Answers-Please ExplainSECCOM Feedback / Recommendations
Deployment: uses K8s secrets that is generated and stored as CPS is deployed **
CPS relies on the java.UUID mechanism for generating unique identifiers
how about storage of passwords?
...
Your Answers-Please ExplainSECCOM Feedback / Recommendations
CPS has not switched to HTTPS but the plan is to switch to enabling service mesh which should take care of HTTPS/TLS encapsulation.Currently, CPS is compliant and compatible is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. 
CPS service port names has been changed to include http in name

Crypto Credential Agility
...
CPS does not store or save authentication credentials, the only information saved by CPS is data and models either via client's input or initial input from the application start up.
Your Answers-Please ExplainSECCOM Feedback / Recommendations
Usernames and passwords are configured in .yml file of CPS for clients to configure.
When CPS is run with docker, the services use username and passwords that are stored as environment variables.

Deployment: uses K8s secrets that is generated and stored as CPS is deployed **
[TH] how about storage of usernames and passwords for REST access?
...
Your Answers-Please ExplainSECCOM Feedback / Recommendations
CPS has not switched to HTTPS but the plan is to switch to enabling service mesh which should take care of HTTPS/TLS encapsulation.There has been a POC created as part of this plan. **is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. 
CPS service port names has been changed to include http in name

Crypto Used Network
Does your software have network communications inbound or outbound? If so, do you support secure protocols for all such network communications?
...
Your Answers-Please ExplainSECCOM Feedback / Recommendations
CPS only communicates with components within ONAP.
CPS's primary communication is through HTTP.
CPS uses KAFKA, and as a listener, in KAFKA we use PLAINTEXT communication, which is also KAFKA's default for communication, at a later stage the Kafka provider ( eg. Apache, Confluent, or Strimizi Kafka [which is planned to be used] ) can enable the security by default i.e the default way of communication.
...

**CPS components are deployed within a pod, all communications in PLAINTEXT are within the pod. Any communication outside the pods is managed via the service mesh.


Crypto Verification Private
Does your software use outbound HTTPS connections? If so, does it perform certificate verification before sending HTTP headers with private information (such as secure cookies)
...
Your Answers-Please ExplainSECCOM Feedback / Recommendations
CPS  has not switched to HTTPS but the plan is to switch to enabling service mesh which should take care of HTTPS/TLS encapsulation.There has been a POC created as part of this plan. **is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. 
CPS service port names has been changed to include http in name