...
| Jira Legacy | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
Follow up Jira for documentation -
| Jira Legacy | ||||||
|---|---|---|---|---|---|---|
|
Security Knowledge
Know Secure Design
...
If so, please provide a URL to the pages on wiki.onap.org or onap.readthedocs.io that have the architecture or high level design. If not, please describe the high level design here using one or more paragraphs.
...
If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io. If not, please describe the security requirements here using one or more paragraphs.
...
If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io that describe how the project meets its security goals. If not, please describe here (using one or more paragraphs) how the project meets its security goals.
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
All of the authorization/authentication is being managed by service mesh - using the authorizationPolicy implemented into SM. | ? 2023/8/22: move information in "Your Answer" to the security documentation. Please expand on the use of configurable usernames+passwords and what they allow. 2023/8/22: add password use and protection to security documentation. Determine if spring is doing authentication, authorization or both. If PF is storing passwords in order to call APIs, document the secure storage and access of the passwords. 2023/8/22: cryptography provided by K8S using secure algorithms and ciphers. |
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
No crypto being used. | ❌ Doesn't answer the question 2023/8/22: PF to document all uses of cryptographic algorithms within the PF application. UUID generation is not part of cryptography. |
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
No crypto is being used | ❌ Doesn't answer the question |
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Passwords are in configuration files, can be replaced without code recompilation, but requires application restartCredentials are managed by k8s secrets. | ❌ Doesn't answer the question |
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
As mentioned above, we need to add to documentation that PF is supposed to run within OOM deployment. That said, SM is managing all communication. | ? is HTTP protected by mesh and HTTPS?
|
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
As mentioned above, we need to add to documentation that PF is supposed to run within OOM deployment. That said, SM is managing all communication. | ❌ Doesn't answer the question service mesh takes care of http communications |