...
| Jira Legacy | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
Security Knowledge
Know Secure Design
Do the committers and PTL know how to design secure software? Do the reviewers of OJSI tickets know secure design?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| Yes - the PF team follows the best common practices regarding security and possible vulnerabilities |
Implement Secure Design
Do the committers and PTL apply secure design principles when reviewing software for merging?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| Yes - the PF team/PTL/committers review and look for security issues and recommend fixes before merging. |
Know Common Errors
Do the committers and PTL understand commonly found errors (and how to counter or mitigate them)? Do they apply these principles when reviewing software for merging?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| Yes - the PF team & PTL are aware of common security risks and how to mitigate them |
No Leaked Credentials
Do the committers and PTL verify that there are no non-test credentials and no non-test private keys in code to be merged?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
We have public user/password in configuration files, including test files. It's recommended to change it and most of the non-test usage is done with helm charts, which generate secrets. |
Security Documentation
Documentation Architecture
Does your project have an architecture or high level design documented?
...
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
ONAP documentation - https://docs.onap.org/projects/onap-policy-parent/en/latest/index.html |
Documentation Security
pDoes your project have a description of what a an user of your roject project can and cannot expect in terms of security from the software produced by the project, (In other words, what are its 'security requirements'?)
...
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
Security documentation?All the resources that can be accessed in PF require authentication |
Assurance Case
Does your project actually meet its documented security requirements?
...
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|
Vulnerability Mitigation
...
Test cases are found at https://github.com/onap/policy-docker/tree/master/csit/resources/tests showing that authentication must be done before interacting with any resource. ONAP docs describring how to run test cases https://docs.onap.org/projects/onap-policy-parent/en/latest/development/devtools/testing/csit.html |
Vulnerability Mitigation
Vulnerabilities Critical Fixed
Have you closed all issues filed against your project in sonarcloud that are CRITICAL or BLOCKERs?
...
| Cloak |
|---|
All critical vulnerabilities should be fixed rapidly after they are reported. [vulnerabilities_critical_fixed P] |
| Your Answer-Please Explain | SECCOM Feedback / Recommendations | Sonarcloud reports can be found @ | -Please Explain | SECCOM Feedback / Recommendations |
|---|---|---|---|---|
Sonarcloud reports can be found at: https://sonarcloud.io/project/overview?id=onap_policy-apex-pdp https://sonarcloud.io/project/overview?id=onap_policy-api https://sonarcloud.io/project/overview?id=onap_policy-clamp https://sonarcloud.io/project/overview?id=onap_policy-common https://sonarcloud.io/project/overview?id=onap_policy-distribution https://sonarcloud.io/project/overview?id=onap_policy-drools-applications https://sonarcloud.io/project/overview?id=onap_policy-drools-pdp https://sonarcloud.io/project/overview?id=onap_policy-gui https://sonarcloud.io/project/overview?id=onap_policy-models https://sonarcloud.io/project/overview?id=onap_policy-pap https://sonarcloud.io/project/overview?id=onap_policy-xacml-pdp |
Vulnerabilities Fixed 60 Days
Are all vulnerabilities that are reported against your project, either through an OJSI ticket or publicly from CVE reports, fixed within two months of being reported?
...
| Cloak |
|---|
There MUST be no unpatched vulnerabilities of medium or higher severity that have been publicly known for more than 60 days. [vulnerabilities_fixed_60_days P] |
...
picked solution). [vulnerabilities_fixed_60_days P] |
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
We try to keep up to date on fixing vulnerabilities reported on IQ Nexus, except when dependency updates break the current code and a study is necessary to mitigate functionalities not working. |
Non-Cryptographic Software Questions
The following are a few issues regarding your project's software as delivered that are not cryptographic-related.
Input Validation
Does your application accept input from potentially untrusted sources? If so, do you ensure that the input is valid before processing it?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
BeanValidation ?is used for any request coming in, checking if format and type rules are matched. |
Hardening
Does your project apply hardening mechanisms so that software defects are less likely to result in security vulnerabilities?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
No UIData sensitive? No encryption, as data processed by PF hasn't been tagged as sensitive. The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation. When PF runs with docker, the services use usernames and passwords that are stored as environment variables. For helm deployments PF uses K8s secrets which are generated and stored as the application is deployed. |
Cryptographic-specific Software Questions
The following questions all deal with cryptographic issues.
Crypto Call – Generic
Does your software implement any cryptographic functions, such as hash functions, instead of calling on software specifically designed to implement cryptographic functions?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| N/A |
Crypto Random - Generic
Does your software use random information? If so, does it use a cryptographically secure random number generator?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
UUID random keys |
Crypto Weaknesses
Does your software depend on any cryptographic algorithms or modes that have known serious weaknesses?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Usernames and passwords are configurable by the clients via passing the environment variables for use in application.yml file. When PF runs with docker, the services use usernames and passwords that are stored as environment variables. For helm deployments PF uses K8s secrets which are generated and stored as the application is deployed. |
Crypto Working
Does your software depend on any cryptographic algorithms that are known to be broken?
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Usernames and passwords are configurable by the clients via passing the environment variables for use in application.yml file. When PF runs with docker, the services use username and passwords that are stored as environment variables. For helm deployments, PF uses K8s secrets which are generated and stored as the application is deployed. |
Crypto Keylength
Does your software generate any keys? If so, do they use any default key-lengths that are considered insecure?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Crypto Algorithm Agility
Does your software use cryptographic algorithms? If so, can a user of ONAP switch the algorithm if one is found to be broken?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
K8s secrets that are generated and stored as apps are deployed. ACM-Runtime use java.UUID mechanism for generating unique identifiers. |
Crypto Certificate Verification
Does your software use HTTPS? If so, does it do certificate verification of the host certificates by default?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
PF is compliant and compatible with the ongoing service mesh implementation (https://gerrit.onap.org/r/c/oom/+/128543) for ONAP. |
Crypto Credential Agility
Does your software save or process authentication credentials or private cryptographic keys? If so, is that information stored separately from other information?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Usernames and passwords are configurable by the clients via passing the environment variables for use in application.yml file. When CPS is run PF runs with docker, the services use username and passwords that are stored as environment variables. For helm deployments, CPS PF uses K8s secrets which are generated and stored as the application is deployed. |
Crypto TLS1.2
Does your software support HTTPS? If so, is the minimum version allowed TLS1.2?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
PF is compliant and compatible with the ongoing service mesh implementation (https://gerrit.onap.org/r/c/oom/+/128543) for ONAP. |
Crypto Used Network
Does your software have network communications inbound or outbound? If so, do you support secure protocols for all such network communications?
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
PF only communicates with components within ONAP. PF's primary communication is through HTTP. PF uses Kafka or REST api interfaces between PF components and service mesh for other communications. |
Crypto Verification Private
Does your software use outbound HTTPS connections? If so, does it perform certificate verification before sending HTTP headers with private information (such as secure cookies)
...