Please find below the Minutes of Meetings and recording for the SECCOM meeting that was held on 19th of March 2024.
| Jira No | Summary | Description | Status | Solution | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| OSA (SecCOM) key updates and benefits | Reference: New Delhi Release Key Updates OSA = no changes as there were no vulnerabilities raised externally to ONAP Add python compatibility module - recent merge for Thomas We could add CLM scans for NG portal | done | ||||||||||
| ONESummit | The session agenda for ONE Summit 2024 has just been published - you can view it here. (Note, the keynotes will be announced later.) APRIL 29 – MAY 1, 2024 | IN-PERSON DTF topics: Adding AI/ML security within SDLC. NIST document with threat models. Testing aspects whether model is working as supposed to. Maintaining open source lifecycle. Improving conformance - OpenSSF LFN DTF sessions wiki is, https://wiki.lfnetworking.org/display/LN/2024-05+LFN+Developer+Event+Sessions | ongoing | Draft of the deck will be prepared by Muddasar for futher discussion with SECCOM team. | IT-26130 Add Image signing in ONAP CI/CD Pipeline | Image signing for ONAP Docker Image was turned on. We still have permanent solution pending changes expected from re-evaluating of CI/CD workflow. LF IT will have All hand in workshop where they will discuss and propose GitHub actions architecture. Muddasar Ahmed LF IT Dev Eng is meeting week of 1/22, they will report back proposed plan changes after this week's meeting. Hacathon type pf meeting was done with ideas brainstorming. We expect new process flow for releasing software and not losing SBOM and signing capabilities while reengineering pipeline. We will review Github actions in the future as soon as it is available with final signing artefacts. | closed ticket | Muddasar Ahmed checked with Jess and Matt when and where workshop would take place. 1/22/24- this week. San Diego- Monday to Thursday hackathon to decide on the CI/CD pipeline. Expected update and decision from Jess and Matt 2nd week of February. To check update for TSC. | LFN AI/ML use cases | ||||
| GitHub Actions integration pipeline | LF IT migrating CI pipeline to GitHub actions - may take to the end of fall or later, once ONAP is completed for GitHub Actions , we will do security review. Last update from Matt is that LF IT is continously shipping one project at a time. | open - WIP | ||||||||||
| LFN AI/ML use cases | Muddasar Ahmed presented the draft deck about LFN AI/ML use cases. Maggie shared link: https://www.nist.gov/itl/ai-risk-management-framework We need to have Ops feedback (NOC manager) on AI, what pain point could be solved by AI. Deck shared with Marian from Orange, feedback expected in first week of December. Under WG 11 in ORAN Alliance (doing standards for ORAN) - threat analysis will be done in the domain of AI security - OWASP TOP 10 - planned by March'24. Runtime influence under interest. Maggie shared the link: https://www.cisa.gov/news-events/alerts/2023/11/26/cisa-and-uk-ncsc-unveil-joint-guidelines-secure-ai-system-development Feedback from Marian received to be discussed at the next SECCOM. China Mobile and Infosys would like to work on use cases. First call done yesterday, agreed on a model to move forward. Intent Based Mode would use Generative AI. 3 layers approach: business layer, services layer, domain layer. Each Intent Manager would have its own AI. Generic model would be used: business language into ONAP consummable, for services more data oriented and finally domain oriented. We do not focus on 5G only architecture but rather on any so could be used by any organization. Topic is in forming group. China Mobile and Infosys interested in Intent context. China Telecom is also interested with focused on user input and Intent. Muddasar Ahmed Byung-Woo Jun Maggie update China Telecom: New Delhi - data service. CCVPN use cases - LLM does not give enough intelligence. Develop domain specific model to generate more intelligent decisions. China Mobile & Infosys: Intent based networking - Level 3 autonomy. Infosys is consulting with MNOs and has experience developing small AI-based autonomous loops. New Delhi release: CM/Infosys will deliver LLM for Intent based networking. Intelligent decision making. Post New Delhi will evaluate if the two tracks can leverage each other. UUI is impacted system for both tracks. No impact to other components NSA/Georgia Tech: AI/ML for security. Collecting and tagging security data to correlate the data. Amy Zwarico provided reference to NIST AI 100-2e2023 Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations Call this week booked. AI/ML use cases focus group still works on platform and use cases priorities. CCVPN use case and intent based networking. China Mobile and Infosys starting work on that in more downstream. ORAN WG11 is working on security aspects. WG2 (non-real-time RIC) and WG3 (near-real-time RIC) are working on xApps and rApps (AI/ML capabilities). Need to write LF informative position white paper for AI/ML - team to write constitued. Meeting is planned with convinient time for all contributors. Goal is to produce it by DTF. Structure bulleted paper available on Confluence - https://wiki.lfnetworking.org/pages/viewpage.action?pageId=120652848pageId=120652848 | open - sceleton structure of the document | ||||||||||
| Nephio security working group | Byung-Woo Jun informed SECCOM that the Nephio security WG is holding a joint meeting with the LF security SIG today at 11AM ET. Nephio plans to adopt 80% of OSSF passing badge. Topic further discussed: It was noted that the passing badge should be straight-forward to achieve. The web page tlhansen.us/badging was discussed. Click on “Single Project…” then fill in a search string or badging ID (e.g. "nephio" or "7665"). For Nephio, Tony recommends to sort by “Type+Section” Nephio SIG Security meeting: By: Lucy Hyde When: Tuesday, October 31st, 2023 8:00am to 9:00am (UTC-07:00) Pacific Time - Los Angeles Repeats: Weekly on Tuesday Location: https://zoom.us/j/96025994457 We could support Nephio by sharing our best practices and processes in place. Lucy OOO for the next few weeks? Byung introduced Tony's tool and was positively perceived by Nephio team. Nephio has GUI and talked about UI: AuthN and AuthZ to be shared by Byung. Nephio Sig meeting last week: https://nephio.slack.com/files/U0503L9UA8N/F065V0AAZRQ/sig-security_action_items.pdf?origin_team=T03LMAUL4HH&origin_channel=D065DKWJJ9X No update - info collection ongoing.Byung will join SIG group. Secrets and Service Mesh
Nephio SIG Security discussion topics are:
Byung-Woo Jun Discussing R3 release.
Byung-Woo Jun The following proposals are under review at Nephio SIG Security Nephio Secrets management user story proposal, https://docs.google.com/document/d/1Ce_cR7afovjWsdECkV8kNbPreG5GirfJXP5IrSiABjg/edit?usp=sharing Service Mesh Requirements, https://docs.google.com/document/d/1UtW20GLTbICTUQyeC1Kx6aDnHlf4EqdhmeD29vsHSEM/edit?usp=sharing Identity and Access Management Requirements proposal, https://docs.google.com/document/d/1qxGZI-HwTA0DfUO_hXKlkEpFzTNcmbDd6IO-CO7mLYo/edit?usp=sharing Package validation user story proposal, https://docs.google.com/document/d/1YeyUZUPFCS4bBgh8ShWVPrGs9HMLtrhwFSIDC6Xl3xc/edit?usp=sharing Package validation under preparation. Rahul Jadhav shared his Nephio workload identity. The team plans to review it. Also, Ericsson plans to share Identity and Access management requirements (2nd review) next week. requirements from Workload Identity perspective. https://docs.google.com/presentation/d/1K0gooS9ge181zNXLvA_SNAtGJyK1l77zOsRy6qpv7ME/edit?usp=sharing Additional meeting planned today, E/// will provide user access control. Interest on workload to wokload access control, https://docs.google.com/document/d/1IwWVGASgdOuLHCHYg82WaZaHdOEXyOM1/edit#heading=h.30j0zll Byung presented E/// user access control and wokload access control under interest. SPIFFE in ORAN as study item. Workload identity still to be addressed. Last Tuesday, Shiv Bhagavatula (Nephio SIG Architecture) shared additional Workload Identity design, leveraging SPIFFE infrastructure (SPIRE server, SPIRE agent, SPIFFE Id and SVID…), https://docs.google.com/presentation/d/1L79WrZ64Uar3IrH-jL_IeQTlPoLtXGZKHIIfVCXLoco/edit#slide=id.p. | |||||||||||
| ONAP Security Implementation Status | Byung-Woo Jun TATA Communications supports RBAC, observability, logging, backup, etc. by leveraging the ONAP currently security mechanism (Ingress, Service Mesh) for their own platform. It is possible they contribute the enhancements they made to the ONAP New Delhi release (TBD). Share of code most probably in Oslo release. Andreas is working on enhancements for OOM Team. | |||||||||||
| Container Signing | Review next steps: -select signing software (SECCOM + LFIT) -perform POC with friendly projects (ONAP) -integrate into build process (LFIT) Looking for a volunteering project to work with us. raised at the 18th September PTL's call but no volunteer so far. LF IT would have to prioritized topic. Prioritization is possible with LFN, Muddasar to update ticket.Item discussed with Matt at the lasy PTLs call.Still in evaluation stage, Sigstore under evaluation. Last PTL's meeting LF IT is going to switch from Sig-Util to Sigstore. Timeline not clear - for image/container signing should be relatively fast. For code signing to be elaborated. We would like to have activities around manual signing. We want Sigstore implementation ready to go by New Delhi release. Muddasar Ahmed Waiting for the LFIT CI/CD decision. LF It work in progress. Container signing update
| closed - to be deleted | Muddasar Ahmed to analyze which ONAP project has the most frequent changes in its containers. Muddasar reached out to LF-IT, Jess and her team are analyzing what enhancement has to be made with CI jobs to allow for Container signing. Further updates will be provided when scope and efforts have been assessed. https://jira.linuxfoundation.org/plugins/servlet/desk/portal/2/IT-26130 Topic to be proposed by Pawel to elaborated at upcoming TSC meeting. | |||||||||
| No PTL for AAI, DCAE, OOF | -Andreas Geissler and Thomas Kulik made committers -They will do the work necessary for the projects to participate in the release -TSC approved streamlining process (7 September) -SECCOM will create package upgrade recommendations -TSC will recruit resources to perform upgrades for AAI, DCAE, OOF
Kenny's reply is that we could benefit from Mentorship program. We have to define job description and skills needed. Byung-Woo Jun New Delhi - VFC, SDC PTLs stepped down. Byung-Woo Jun temporarily handling the Release Manager role. DMaaP MR is to be unmaintained. Globar Requirement for MR deprecation - Byung to prepare it. Deprecating component of the project shall be initiated by the PTL, if exists. | ongoing | -Byung will discuss with Andreas and Thomas to coordinate release tasks such as backlog prioritization -Muddasar: someone needs to take backlog management role -Muddasar: no mandated best practice to manage technical debt; call for a statement about code quality – all code will be secure -Muddasar & Amy: bring mandate for code quality to LFN TAC 2023/8/16
| |||||||||
TSC meeting | 3 new features for New Delhi
ARCHCOM approve and recommend architecture changes to TSC. TSC provides final approval or denial. Reviews and changes are tracked through Jira. Muddasar Ahmed recommends including technical debt as part of feature/architectural enhancements. Support for -1 release confirmed. Fiachra wants to retire MR from New Dehli - dependencies must be removed. Byung created Global Requirement for MR retirement. TSC approve Ramesh Murugan Iyer as the Policy PTL | |||||||||||
PTL meeting (March 4th18th) | For the up-to-date PTL list, see Project Status in New Delhi Release Muddasar mentionned about multidomain scenes for security incident and event management for telco. AI could be used to stitching together data from different sources. Work still in progress for NG Portal CLM scans. | |||||||||||
LFN-TAC (DTF F2F) | FY24 priority, security was covered - consensus on ONAP best practices. Platform Maturity Requirements (aka Carrier Grade) New project induction and project graduation criteria documentation accepted. Security - discussion should be a separate WG meeting - security scrum of scrums. LFN Security Forum. Updated meeting agenda for tomorrow's TAC meeting (https://wiki.lfnetworking.org/display/LN/2023-12-06+TAC+Minutes) and presentation planned by Amy and Muddasar:
TAC agreed with the proposal provided by Amy. In 6 months trial period we should have recommendations for secure software development. Projects SECCOM representatives to join those meetings. Sense of ownership to be improved. LFN wide security focus group approved by TAC. Align AI/ML initiatives Creating LFN-wide Security FG L3AF project - Microsoft pulled out XGVela - no active contributors FIDO Muddasar Ahmed requested TAC to make a formal quality statement about LFN produced code. CNCF certification and testing topic recently discussed. Tailor from CNCF and Sana presented the need for certification. CNTI (CloudNative Network Function for Telco) conformance discussion - proposal expected by April to Governing Board. Security whitepaper update under consideration - quality goal statement to be drafted. ORAN Alliance is doing yearly publication on security blog post. CNTI - discussion finished last week. CNTI assets (test and documentation for certifying) moved to LFN. Discussion on Superblueprint and documentation. Migration process in progress. Documentation update - modifying Lifecycle. Confidential computing. | Muddasar Ahmed to check for document availability on software quality goals. | ||||||||||
Technical debt budgeting discussion needed with TSC/TAC - 10% of efforts for app security could be invested. What are best practices to transfer project to Archive or Unmaintained state. This could be part of quality goal. Still waiting for Jill Levato action on thatthat. E-mail was sent by Pawel too. but no response received from Jill. | Muddasar Ahmed to follow with Jill. | |||||||||||
Badging update | Tony presented additional functionalities: www.Bestpractices.dev/en/projects/1718?criteria_level=2 Gap on ONAP badging: no master editor for the badges. Bring up with TSC to find a LFIT resource to fill the role. TSC topic to be added for the upcoming agenda. OpenSSF Badging program to be establised by LFN. New type of Badge - scorecard which is based on GitHub Actions? - 10 different criterias automatically updated. Ongoing discussion with Kenny by Tony - API info to be shared. Standalone version exists and could potentially used in ONAP, so scorecard could be implemented.- 10 different criterias automatically updated. Ongoing discussion with Kenny by Tony - API info to be shared. Standalone version exists and could potentially used in ONAP, so scorecard could be implemented. Few weeks ago at the TSC Sandra was asked to become master editor on ONAP Badging projects. Finally everything was done - she was added as owner of all ONAP projects, existing editors can work as it was. Both Jim and David were removed. All OpenSSF projects will have their own TSCs - Tony was proposed to be one - CONGRATS TONY! | |||||||||||
Package update recommendations | Amy Zwarico my team will create recommendations. Work in Progress. ETA by end of this week. Leverage Nexus-IQ APIs. All recommendations are available on the restricted Wiki. Jira tickets were created for each project. Full list of project jiras. Project Tasks:
| |||||||||||
Lack of CLM scans for NG Portal | Andreas was informed about lack of Jenkins jobs for Nexus-IQ scans. Fiete will work on this as project PTL. Update from Fiete Ostkamp :
Jira opened by Fiete, ongoing support by LF-IT | |||||||||||
NEXT SECCOM MEETING CALL WILL BE HELD ON March 26th 2024 | E/// will share requirements (link) and discussion, Review of the DTF deck. |
Recordings: