"The project MUST have performed a security review within the last 5 years. This review MUST consider the security requirements and security boundary." – Best Practices Badging Criterion

...

If so, please provide a URL to the pages on wiki.onap.org or onap.readthedocs.io that have the architecture or high level design. If not, please describe the high level design here using one or more paragraphs.

...

Your Answer-Please Describe

SECCOM Feedback / Recommendations

Yes, CPS architecture documentation can be found @ https://docs.onap.org/projects/onap-cps/en/latest/architecture.html

Note: Architecture diagram is for the Istanbul release.

Please update "This page reflects the state for Istanbul-R9 release" to reflect the current release.

...

*Page is being updated for the next release to reflect that the architecture diagram reflects the latest release. (https://gerrit.onap.org/r/c/cps/+/133557)

The ONAP architecture diagram (London-R12 Architecture diagram) is displayed on Configuration Persistence Service Project wiki as part of explaining the project's concept

Please refer to the latest ONAP architecture diagram.

London-R12 Architecture Diagram

Documentation Security

Does your project have a description of what a user of your project can and cannot expect in terms of security from the software produced by the project, (In other words, what are its 'security requirements'?)

If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io. If not, please describe the security requirements here using one or more paragraphs.

...

Your Answer-Please Describe

SECCOM Feedback / Recommendations

None available

CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable

Please add a statement about this to the end of your architecture document (or in another wiki page), with a heading such as "CPS Security Requirements."

Assurance Case

Does your project actually meet its documented security requirements?

...

Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS

Please refer to the latest ONAP architecture diagram.

London-R12 Architecture Diagram

Please elaborate this statement: "Usernames and passwords are configurable by the clients via configuring the application .yml file".

Expectation: passwords are not in yml file. The yml should point to user store (e.g. LDAP or K8s secrets).

+1

Assurance Case

Does your project actually meet its documented security requirements?

If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io that describe how the project meets its security goals. If not, please describe here (using one or more paragraphs) how the project meets its security goals.

...

Please add a statement about this to the end of your security requirements section/document. At a minimum, it should

Your Answer-Please Describe

SECCOM Feedback / Recommendations

None availableConfiguration Persistence Service Project#CPSSECURITYREQUIREMENTS

CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable

rest API wherein username and passwords are configurable.

CPS has no logging of sensitive information such as usernames and passwords in plain text. The log files are only accesible withing the authorized users of the application deployment.

CPS is in the process (as part of ONAP service mesh implementation) of migrating to service mesh, currently CPS application is fully-compatible with all the requirements, to provide encryption in transit to avoid unauthorized accesses and data breaches.

CPS does not run docker containers or services as 'root'.

Please add these statements to a new Security Assurance section just after: Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS. — these statements are the same as under security requirements

Also add statements that indicate how you protect your username and password configurations. (See other questions on hashing of secrets

and

, use of crypto and permissions on files.)

Vulnerability Mitigation

Vulnerabilities Critical Fixed

...

Cloak

The project results MUST check all inputs from potentially untrusted sources to ensure they are valid (an *allowlist*), and reject invalid inputs, if there are any restrictions on the data at all.
Note that comparing input against a list of 'bad formats' (aka a *denylist*) is normally not enough, because attackers can often work around a denylist. In particular, numbers are converted into internal formats and then checked if they are between their minimum and maximum (inclusive), and text strings are checked to ensure that they are valid text patterns (e.g., valid UTF-8, length, syntax, etc.). Some data may need to be 'anything at all' (e.g., a file uploader), but these would typically be rare.

_{[input_validation S]}

Your Answer-Please Explain

SECCOM Feedback / Recommendations

Our application expects (any) client to upload models and data to be stored.

These models and data are validated via the 3rd party tool - OpenDayLight Yang parser which is part of CPS and not a separate microservice. These are only stored once the parser accepts that it is valid and returns an exception for invalid models and data.

Additionally, inputs to all REST endpoints are validated, e.g. CM handle IDs, CPS paths, timestamps

Is the ODL Yang parser included in CPS or is it a separate "microservice"?

How does CPS differentiate between trusted and untrusted sources?

+1

Hardening

Does your project apply hardening mechanisms so that software defects are less likely to result in security vulnerabilities?

...

Your Answer-Please Explain

SECCOM Feedback / Recommendations

CPS does not have a UI and does not use javascript

The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation.Usernames and passwords are configured in .yml file of CPS for clients to configure.

When CPS is run with docker, the services use username usernames and passwords that are stored as environment variables.

While for testing purposes, all credentials are hard-coded, for deployments, CPS uses K8s secrets which are generated and stored as the application is deployed.x

How are usernames and passwords stored?

Are passwords stored hashed

where CPS acts as an authenticator?

Please refer to comment above in Documentation security.

As it is not part of the production: +1

Cryptographic-specific Software Questions

...

Your Answers-Please Explain	SECCOM Feedback / Recommendations
CPS does generate random UUIDs for notifications. These UUIDs are generated via the built in java libraries (java.util.UUID).	+1

Crypto Weaknesses

Does your software depend on any cryptographic algorithms or modes that have known serious weaknesses?

...

[TH] how about storage of passwords?

Your Answer-Please Explain

SECCOM Feedback / Recommendations

N/A

Usernames and passwords are configurable by the clients via passing the environment variables for use in application.yml file.

When CPS is run with docker, the services use username and passwords that are stored as environment variables.

For deployments, CPS uses K8s secrets which are generated and stored as the application is deployed.

Please refer to comment above in Documentation security.

Crypto Working

Does your software depend on any cryptographic algorithms that are known to be broken?

...

No[TH] how about storage of usernames & passwords?

Your Answer-Please Explain

SECCOM Feedback / Recommendations

Usernames and passwords are

configured in

configurable by the clients via passing the environment variables for use in application.yml file

of CPS for clients to configure

.

When CPS is run with docker, the services use username and passwords that are stored as environment variables.

.

For deployments, CPS uses K8s secrets which are generated and stored as the application is deployed.

Please refer to comment above in Documentation security.

Crypto Keylength

Does your software generate any keys? If so, do they use any default key-lengths that are considered insecure?

...

Your Answers-Please Explain	SECCOM Feedback / Recommendations
CPS does not generate any keys	+1

Crypto Algorithm Agility

Does your software use cryptographic algorithms? If so, can a user of ONAP switch the algorithm if one is found to be broken?

...

how about storage of passwords?

Your Answers-Please Explain

SECCOM Feedback / Recommendations

This does not apply

For deployments, CPS uses K8s secrets that are generated and stored as CPS is deployed.

CPS relies on java.UUID mechanism for generating unique identifiers.

+1

Crypto Certificate Verification

...

Cloak

This applies to both ingress into and egress from your project.

For ingress, this applies to validation of the client certificates coming into your system.
For egress, this applies to validation of the host certificates for external systems that your system reads from or sends to.

The software produced by the project MUST, if it supports TLS, perform TLS certificate verification by default when using TLS, including on sub-resources.
Note that incorrect TLS certificate verification is a common mistake. For more information, see The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software by Martin Georgiev et al. and Do you trust this application? by Michael Catanzaro.

Note: One aspect of this is that, if something is missing that prevents the TLS from working, the software must NOT fall back to insecure mode but must instead prevent communication. If an insecure mode is allowed, it MUST be explicitly configured.

Note 2: If all of your traffic, either ingress or egress, is travelling through the ONAP mesh, then make a statement about that.

_{[crypto_certificate_verification S]}

CPS has not switched to HTTPS but the plan is to switch to enabling service mesh which should take care of HTTPS/TLS encapsulation.

Currently,

Your Answers-Please Explain

SECCOM Feedback / Recommendations

-Please Explain

SECCOM Feedback / Recommendations

CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP.

CPS service port names has been changed to include http in name.

+1

Crypto Credential Agility

...

CPS does not store or save authentication credentials, the only information saved by CPS is data and models either via client's input or initial input from the application start up.[TH] how about storage of usernames and passwords for REST access?

Your Answers-Please Explain

SECCOM Feedback / Recommendations

Usernames and passwords are

configured in .yml file of CPS for clients to configure

configurable by the clients via passing the environment variables for use in application.yml file.

When CPS is run with docker, the services use username and passwords that are stored as environment variables.

For deployments, CPS uses K8s secrets which are generated and stored as the application is deployed.

Please refer to comment above in Documentation security.

Crypto TLS1.2

Does your software support HTTPS? If so, is the minimum version allowed TLS1.2?

...

Your Answers-Please Explain

SECCOM Feedback / Recommendations

CPS has not switched to HTTPS but the plan is to switch to enabling service mesh which should take care of HTTPS/TLS encapsulation.There has been a POC created as part of this plan. **is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP.

CPS service port names has been changed to include http in name.

+1

Crypto Used Network

Does your software have network communications inbound or outbound? If so, do you support secure protocols for all such network communications?

...

Your Answers-Please Explain

SECCOM Feedback / Recommendations

CPS only communicates with components within ONAP.

CPS's primary communication is through HTTP.

CPS uses KAFKA, and as a listener, in KAFKA we use PLAINTEXT communication, which is also KAFKA's default for communication, at a later stage the Kafka provider ( eg. Apache, Confluent, or Strimizi Kafka [which is planned to be used] ) can enable the security by default i.e the default way of communication.communication.

CPS components are deployed within a pod, all communications in PLAINTEXT are within the pod. Any communication outside the pods is managed via the service mesh.

+1

Crypto Verification Private

...

Your Answers-Please Explain

SECCOM Feedback / Recommendations

CPS has not switched to HTTPS but the plan is to switch to enabling service mesh which should take care of HTTPS/TLS encapsulation.There has been a POC created as part of this plan. **is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP.

CPS service port names has been changed to include http in name.

+1

Versions Compared

Old Version 18

New Version Current

Key

Documentation Security

Assurance Case

Assurance Case

Vulnerability Mitigation

Vulnerabilities Critical Fixed

Hardening

Cryptographic-specific Software Questions

Crypto Weaknesses

Crypto Working

Crypto Keylength

Crypto Algorithm Agility

Crypto Certificate Verification

Crypto Credential Agility

Crypto TLS1.2

Crypto Used Network

Crypto Verification Private

Page Comparison

Versions Compared

Old Version 18

New Version Current

Key

Documentation Security

Assurance Case

Assurance Case

Vulnerability Mitigation

Vulnerabilities Critical Fixed

Hardening

Cryptographic-specific Software Questions

Crypto Weaknesses

Crypto Working

Crypto Keylength

Crypto Algorithm Agility

Crypto Certificate Verification

Crypto Credential Agility

Crypto TLS1.2

Crypto Used Network

Crypto Verification Private