Versions Compared

Old Version 9

changes.mady.by.user Tony Hansen

Saved on

compared with

New Version 10

changes.mady.by.user Adheli Tavares

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Replying comments and redoing some answers.

...

Cloak

The project must implement secure design principles (from 'know secure design').

For example, the project results should have fail-safe defaults (access decisions should deny by default, and projects' installation should be secure by default). They should also have complete mediation (every access that might be limited must be checked for authority and be non-bypassable). Note that in some cases principles will conflict, in which case a choice must be made (e.g., many mechanisms can make things more complex, contravening 'economy of mechanism' / keep it simple).

Implement secure design builds on the question above of "know secure design". For ONAP, the committers must all know the secure design principles and reviewing the code must always includes looking at it from the point of review of the security principles.

It's crucial to document the secure design practices and software design/coding standards and code review. This NIST SSDF document provides additional details: 

[implement_secure_design S]


Your Answer-Please ExplainSECCOM Feedback / Recommendations
Yes - the PF team/PTL/committers review and look for security issues and recommend fixes before merging.

?

  • does the team fix the findings identified by SonarCloud and NexusIQ? 
    • depends on how the fix needs to be implemented. some of the current issues require dependency updates that would break code and are part of the java-17 upgrade.

Know Common Errors

Do the committers and PTL understand commonly found errors (and how to counter or mitigate them)? Do they apply these principles when reviewing software for merging?

...

Your Answer-Please DescribeSECCOM Feedback / Recommendations

All the resources that can be accessed in PF require authentication

❌

  • Please submit link with your security documentation + information about what capabilities authentication provides.
  • Do you require authorization? No
  • Can PF restrict access to resources based on identity? if so what mechanisms are used? No
  • Are there different levels of authorization once you've authenticated? No
  • Is there authentication and authorization on the events being acted? Authentication only
  • What kind of security is used to control access to the network elements being controlled? PF is using service mesh

Assurance Case

Does your project actually meet its documented security requirements?

...

Your Answer-Please ExplainSECCOM Feedback / Recommendations

Sonarcloud reports can be found at:

https://sonarcloud.io/project/overview?id=onap_policy-apex-pdp

https://sonarcloud.io/project/overview?id=onap_policy-api

https://sonarcloud.io/project/overview?id=onap_policy-clamp

https://sonarcloud.io/project/overview?id=onap_policy-common

https://sonarcloud.io/project/overview?id=onap_policy-distribution

https://sonarcloud.io/project/overview?id=onap_policy-drools-applications

https://sonarcloud.io/project/overview?id=onap_policy-drools-pdp

https://sonarcloud.io/project/overview?id=onap_policy-gui

https://sonarcloud.io/project/overview?id=onap_policy-models

https://sonarcloud.io/project/overview?id=onap_policy-pap

https://sonarcloud.io/project/overview?id=onap_policy-xacml-pdp

❌

The following have security hotspots

policy-common, policy-pap

The latter is a high priority item that is >1 year old.

  • the mentioned security hotspot is a piece of code necessary for ingestion in another private service - it would change both implementations for token exchange, which is not in question.


How are OJSIs dealt with?



...

Your Answer-Please ExplainSECCOM Feedback / Recommendations

We try to keep up to date on fixing vulnerabilities reported on IQ Nexus, except when dependency updates break the current code and a study is necessary to mitigate functionalities not working.

?

And sonar cloud?

  • sonar cloud is also checked, the team has sonar cloud configured with IDEs.

policy-pap has a high severity security item reported in sonarcloud for >1 year

  • see answer above.


Non-Cryptographic Software Questions

...

Your Answer-Please ExplainSECCOM Feedback / Recommendations

No UI

No encryption, as data processed by PF hasn't been tagged as sensitive.

The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation.

When PF runs with docker, the services use usernames and passwords that are stored as environment variables.

For helm deployments PF uses K8s secrets which are generated and stored as the application is deployed.

?

  • Is https used? - no
  • Has the project migrated to the service mesh which provides https and RBAC - yes


Cryptographic-specific Software Questions

...

Your Answers-Please ExplainSECCOM Feedback / Recommendations

UUID random keys

?

How are UUIDs generated? (There are many bad ways.)

  • using java native way of generation java.util.UUID

Crypto Weaknesses

Does your software depend on any cryptographic algorithms or modes that have known serious weaknesses?

...

Cloak

The default security mechanisms within the software produced by the project SHOULD NOT depend on cryptographic algorithms or modes with known serious weaknesses (e.g., the SHA-1 cryptographic hash algorithms, or the CBC mode in SSH).
Concerns about CBC mode in SSH are discussed in CERT: SSH CBC vulnerability.

[crypto_weaknesses PS]


Your Answer-Please ExplainSECCOM Feedback / Recommendations
Usernames and

Depends of user managing crypto their own passwords - passwords are configurable

by the clients via passing the environment variables for use

in application.

yml file. ????

When PF runs with docker, the services use usernames and passwords that are stored as environment variables.

For helm deployments PF uses K8s secrets which are generated and stored as the application is deployed

yaml for Spring applications (api, pap and acm) and .json configuration files for others. The credentials provided in these files are used for authentication (no authorization dealt in any of PF components) to use any of the REST APIs provided by PF.

?

Please expand on the use of configurable usernames+passwords and what they allow.

Crypto Working

Does your software depend on any cryptographic algorithms that are known to be broken?

...

Your Answer-Please ExplainSECCOM Feedback / Recommendations

Usernames and passwords are configurable by the clients via passing the environment variables for use in application.yml file.

When PF runs with docker, the services use username and passwords that are stored as environment variables.

For helm deployments, PF uses K8s secrets which are generated and stored as the application is deployed

UUID generator is being used, but for IDs, not for security concers.

❌

Doesn't answer the question

...

Your Answers-Please ExplainSECCOM Feedback / Recommendations

No keys being generated for use and in OOM, PF is part of service mesh to connect to other services.

UUID generated (using java native way) are for identifiers.

❌

Doesn't answer the question

...

Your Answers-Please ExplainSECCOM Feedback / Recommendations

K8s secrets that are generated and stored as apps are deployed.

ACM-Runtime use java.UUID mechanism for generating unique No crypto is being used, aside from UUID generated (using java native way), which are used for identifiers.

❌

Doesn't answer the question

...

Your Answers-Please ExplainSECCOM Feedback / Recommendations

Usernames and passwords are configurable by the clients via passing the environment variables for use in application.yml file.

When PF runs with docker, the services use username and passwords that are stored as environment variables.

For helm deployments, PF uses K8s secrets which are generated and stored as the application is deployedPasswords are in configuration files, can be replaced without code recompilation, but requires application restart.

❌

Doesn't answer the question

...

Your Answers-Please ExplainSECCOM Feedback / Recommendations

PF only communicates with components within ONAP.

PF's primary communication is through HTTP.

PF uses Kafka or REST api interfaces between PF components and service mesh for other communications.


?

is HTTP protected by mesh and HTTPS?

  • yes

Crypto Verification Private

...

Your Answers-Please ExplainSECCOM Feedback / Recommendations

PF is compliant and compatible with the ongoing service mesh implementation (https://gerrit.onap.org/r/c/oom/+/128543) for ONAP. 

❌

Doesn't answer the question

  • service mesh takes care of http communications