"The project MUST have performed a security review within the last 5 years. This review MUST consider the security requirements and security boundary." – Best Practices Badging Criterion
...
If so, please provide a URL to the pages on wiki.onap.org or onap.readthedocs.io that have the architecture or high level design. If not, please describe the high level design here using one or more paragraphs.
...
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
Yes, CPS architecture documentation can be found @ https://docs.onap.org/projects/onap-cps/en/latest/architecture.html *Page is being updated for the next release to reflect that the architecture diagram reflects the latest release. (https://gerrit.onap.org/r/c/cps/+/133557) The ONAP architecture diagram (London-R12 Architecture diagram) is displayed on Configuration Persistence Service Project wiki as part of explaining the project's concept | Please refer to the latest ONAP architecture diagram. |
Documentation Security
Does your project have a description of what a user of your project can and cannot expect in terms of security from the software produced by the project, (In other words, what are its 'security requirements'?)
If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io. If not, please describe the security requirements here using one or more paragraphs.
...
| Your Answer-Please Describe | SECCOM Feedback / Recommendations | |
|---|---|---|
None available CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS | Please refer to the latest ONAP architecture diagram. London-R12 Architecture Diagram Please elaborate this statement: "Usernames and passwords are configurable by the clients via configuring the application .yml file". Expectation: passwords are not in yml file. The yml should point to user store (e.g. LDAP or K8s secrets). +1 |
Assurance Case
Does your project actually meet its documented security requirements?
If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io that describe how the project meets its security goals. If not, please describe here (using one or more paragraphs) how the project meets its security goals.
...
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable. CPS has no logging of sensitive information such as usernames and passwords in plain text. The log files are only accesible withing the authorized users of the application deployment. CPS is in the process (as part of ONAP service mesh implementation) of migrating to service mesh, currently CPS application is fully-compatible with all the requirements, to provide encryption in transit to avoid unauthorized accesses and data breaches. CPS does not run docker containers or services as 'root'. | Please add these statements to a new Security Assurance section just after: Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS. — these statements are the same as under security requirements Also add statements that indicate how you protect your username and password configurations. (See other questions on hashing of secrets, use of crypto and permissions on files.) |
Vulnerability Mitigation
Vulnerabilities Critical Fixed
...
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS does not have a UI and does not use javascript The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation. When CPS is run with docker, the services use usernames and passwords that are stored as environment variables. While for testing purposes, all credentials are hard-coded, for deployments, CPS uses K8s secrets which are generated and stored as the application is deployed.x | How are usernames and passwords stored? Are passwords stored hashed where CPS acts as an authenticator? Please refer to comment above in Documentation security. As it is not part of the production: +1 |
Cryptographic-specific Software Questions
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. CPS service port names has been changed to include http in name. | +1 |
Crypto Credential Agility
...
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. CPS service port names has been changed to include http in name. | +1 |
Crypto Used Network
Does your software have network communications inbound or outbound? If so, do you support secure protocols for all such network communications?
...