Versions Compared

Old Version 10

changes.mady.by.user Adheli Tavares

Saved on

compared with

New Version Current

changes.mady.by.user Adheli Tavares

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Jira Legacy
serverSystem Jira
columnIdsissuekey,summary,issuetype,created,updated,duedate,assignee,reporter,priority,status,resolution
columnskey,summary,type,created,updated,due,assignee,reporter,priority,status,resolution
serverId4733707d-2057-3a0f-ae5e-4fd8aff50176
keyPOLICY-4681


Follow up Jira for documentation -

Jira Legacy
serverSystem Jira
serverId4733707d-2057-3a0f-ae5e-4fd8aff50176
keyPOLICY-4817

Security Knowledge

Know Secure Design

...

If so, please provide a URL to the pages on wiki.onap.org or onap.readthedocs.io that have the architecture or high level design. If not, please describe the high level design here using one or more paragraphs.

...

If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io. If not, please describe the security requirements here using one or more paragraphs.

...

Your Answer-Please DescribeSECCOM Feedback / Recommendations

All the resources that can be accessed in PF require authentication

❌

  • Please submit link with your security documentation + information about what capabilities authentication provides.
  • Do you require authorization? No
  • Can PF restrict access to resources based on identity? if so what mechanisms are used? No
  • Are there different levels of authorization once you've authenticated? No
  • Is there authentication and authorization on the events being acted? Authentication only
  • What kind of security is used to control access to the network elements being controlled? PF is using service mesh
  • 2023/8/22: PF will create Montreal Jira ticket to document security architecture and assurance.

Assurance Case

Does your project actually meet its documented security requirements?

If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io that describe how the project meets its security goals. If not, please describe here (using one or more paragraphs) how the project meets its security goals.

...

Your Answer-Please DescribeSECCOM Feedback / Recommendations

Test cases are found at https://github.com/onap/policy-docker/tree/master/csit/resources/tests showing that authentication must be done before interacting with any resource.

ONAP docs describring how to run test cases https://docs.onap.org/projects/onap-policy-parent/en/latest/development/devtools/testing/csit.html

?

Good start

  • answer questions above under documentation security,
  • create Wiki page for your Assurance Case (or a section on the Documentation Security page)
  • provide answers there.
  • In particular describe how your security goals are being met by your implementation, or not
  • provide here a link to that Wiki page/section
  • 2023/8/22: PF will create Montreal Jira ticket to document security architecture and assurance.

Vulnerability Mitigation

Vulnerabilities Critical Fixed

...

Your Answer-Please ExplainSECCOM Feedback / Recommendations

Sonarcloud reports can be found at:

https://sonarcloud.io/project/overview?id=onap_policy-apex-pdp

https://sonarcloud.io/project/overview?id=onap_policy-api

https://sonarcloud.io/project/overview?id=onap_policy-clamp

https://sonarcloud.io/project/overview?id=onap_policy-common

https://sonarcloud.io/project/overview?id=onap_policy-distribution

https://sonarcloud.io/project/overview?id=onap_policy-drools-applications

https://sonarcloud.io/project/overview?id=onap_policy-drools-pdp

https://sonarcloud.io/project/overview?id=onap_policy-gui

https://sonarcloud.io/project/overview?id=onap_policy-models

https://sonarcloud.io/project/overview?id=onap_policy-pap

https://sonarcloud.io/project/overview?id=onap_policy-xacml-pdp

❌

The following have security hotspots

policy-common, policy-pap

The latter is a high priority item that is >1 year old.

  • the they mentioned security hotspot is a piece of code necessary for ingestion in another private service - it would change both implementations for token exchange, which is not in question.
How are OJSIs dealt with?
  • 2023/8/22: PF review the hotspot in policy-common and policy-pap to determine if they are false positives.
  • 2023/8/22: SECCOM will investigate disabling false positives in sonarcloud.



Vulnerabilities Fixed 60 Days

...

Your Answer-Please ExplainSECCOM Feedback / Recommendations

We try to keep up to date on fixing vulnerabilities reported on IQ Nexus, except when dependency updates break the current code and a study is necessary to mitigate functionalities not working.

?

And sonar cloud?

  • sonar cloud is also checked, the team has sonar cloud configured with IDEs.

policy-pap has a high severity security item reported in sonarcloud for >1 year

  • see answer above.

Non-Cryptographic Software Questions

...


How are OJSIs dealt with?

  • 2023/8/22: PF will document response process for unplanned security issues that have to be fixed outside of the normal release cycle.


Non-Cryptographic Software Questions

The following are a few issues regarding your project's software as delivered that are not cryptographic-related.

...

Your Answer-Please ExplainSECCOM Feedback / Recommendations

No UI

No encryption, as data processed by PF hasn't been tagged as sensitive.

The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation.

When PF runs with docker, the services use usernames and passwords that are stored as environment variables.

For helm deployments PF uses K8s secrets which are generated and stored as the application is deployed.

?

  • Is https used? - no
  • Has the project migrated to the service mesh which provides https and RBAC - yes

Cryptographic-specific Software Questions

The following questions all deal with cryptographic issues.

Crypto Call – Generic

Does your software implement any cryptographic functions, such as hash functions, instead of calling on software specifically designed to implement cryptographic functions?

...

The user has the option to provide a username/password to the helm chart - in this case a kubernetes secret

will be generated by the chart and used for authentication. Alternatively, the user can provide a secret to the chart values - in this case, no secret

will be generated - the chart will just use the k8s secret provided by the user/deployer

?

  • Is https used? - no
  • Has the project migrated to the service mesh which provides https and RBAC - yes
  • 2023/8/22: document security controls provided by service mesh and K8S: encryption in transit, authentication (policy enforcement, policy decision, and policy information point). PF designed to run in K8S with a service mesh providing security controls.


Cryptographic-specific Software Questions

The following questions all deal with cryptographic issues.

Crypto Call – Generic

Does your software implement any cryptographic functions, such as hash functions, instead of calling on software specifically designed to implement cryptographic functions?

Toggle cloak
 Cloak
If the software produced by the project is an application or library, and its primary purpose is not to implement cryptography, then it SHOULD only call on software specifically designed to implement cryptographic functions; it SHOULD NOT re-implement its own.
[crypto_call P]
...
?
How are UUIDs generated? (There are many bad ways.)
Your Answers-Please ExplainSECCOM Feedback / Recommendations
UUID random keys
  • using java native way of generation java.util.UUID
✅
Crypto Weaknesses
Does your software depend on any cryptographic algorithms or modes that have known serious weaknesses?
...
?
Please expand on the use of configurable usernames+passwords and what they allow
Your Answer-Please ExplainSECCOM Feedback / Recommendations
Depends of user managing crypto their own passwords - passwords are configurable in application.yaml for Spring applications (api, pap and acm) and .json configuration files for others. The credentials provided in these files are used for authentication (no authorization dealt  in any of PF components) to use any of the REST APIs provided by PF.
in any of PF components) to use any of the REST APIs provided by PF.
All of the authorization/authentication is being managed by service mesh - using the authorizationPolicy implemented into SM.
? 2023/8/22: move information in "Your Answer" to the security documentation.
Please expand on the use of configurable usernames+passwords and what they allow.
2023/8/22: add password use and protection to security documentation. Determine if spring is doing authentication, authorization or both. If PF is storing passwords in order to call APIs, document the secure storage and access of the passwords.
2023/8/22: cryptography provided by K8S using secure algorithms and ciphers.
Crypto Working
Does your software depend on any cryptographic algorithms that are known to be broken?
...
Your Answer-Please ExplainSECCOM Feedback / Recommendations
UUID generator is being used, but for IDs, not for security  concersconcerns.
No crypto being used.
❌
Doesn't answer the question
2023/8/22: PF to document all uses of cryptographic algorithms within the PF application. UUID generation is not part of cryptography.
Crypto Keylength
Does your software generate any keys? If so, do they use any default key-lengths that are considered insecure?
...
Your Answers-Please ExplainSECCOM Feedback / Recommendations
No keys being generated for use and us in OOM, PF is part of service mesh to connect to other services.
UUID generated (using java native way) are for identifiers.
❌✅
Doesn't answer the question
...
Your Answers-Please ExplainSECCOM Feedback / Recommendations
No crypto is being used, aside from UUID generated (using java native way), which are used for identifiers.
❌
Doesn't answer the question
...
Your Answers-Please ExplainSECCOM Feedback / Recommendations
Passwords are in configuration files, can be replaced without code recompilation, but requires application restartCredentials are managed by k8s secrets.
❌
Doesn't answer the question
...
Your Answers-Please ExplainSECCOM Feedback / Recommendations
PF only communicates with components within ONAP.
PF's primary communication is through HTTP.
PF uses Kafka or REST api interfaces between PF components and service mesh for other communications.
As mentioned above, we need to add to documentation that PF is supposed to run within OOM deployment. That said, SM is managing all communication.

?
is HTTP protected by mesh and HTTPS?
  • yes
...
Your Answers-Please ExplainSECCOM Feedback / Recommendations
PF is compliant and compatible with the ongoing service mesh implementation (https://gerrit.onap.org/r/c/oom/+/128543) for ONAP. 
As mentioned above, we need to add to documentation that PF is supposed to run within OOM deployment. That said, SM is managing all communication.
❌
Doesn't answer the question
service mesh takes care of http communications