Please see the Minutes of Meetings and recording for the SECCOM meeting that was held on 5th of November 2019.
| Jira No | Summary | Description | Status | Solution |
|---|---|---|---|---|
OJSIs summary for El Alto release: | Krzysztof summarized projects and their attitude towards OJSIs security tickets handling: Still 38 OJSI tickets related to HTTP open while we expose only ~20 HTTP ports. We can close almost half as soon as we get the commit hash-id Worst performing projects
Could be improved
Please follow them
| |||
| ONAP security maturity assessment | Discussion held at the last PTL call yesterday PTLs claim that are missing qualified security experts Idea of SECCOM badging provided per project and per release – discussion point SECCOM is perceived as group of people pushing PTLs and community to do some security related stuff while it should be the other way around: PTLs are asking SECCOM how they could improve their security. SECCOM is not about project management and motivating people to do the security. We should introduce security badging or levels for ONAP projects and sit down together and define what are the requirements for each and every elevel, present those requirements to the projects and at the end of each release to perform the asessment and publish on the release of the project page the list of the projects with their current security status. KPIs defined with release security maturity should be used. CII Badging combines multiple areas, including security. | |||
SECCOM-258 - Getting issue details... STATUS | Improve security documentation in Frankfurt | Initiate a work item for Security Architecture documentation
Harald has created a wiki page based on F2F meeting | ||
REQ-255 - Getting issue details... STATUS | ISTIO work in Frankfurt | -Intel completed a POC for ONAP4K8S profile and will continue that for R6 | Need to assign Jira to Intel | |
| Frankfurt Security Release Manager support | -SDNC fix for the 3 remote code execution vulnerabilities through integration with AAF -Release management help projects manage OJSI resolution – determine resource needs, track progress, raise issues | Need Release Manager support for both activities | ||
| - | Review of El Alto key deliverables | -Known vulnerabilities analysis - ongoing -Synch with Portal team on their components upgrades – it seems that only few were upgraded – feedback from Portal team received under jira ticket. -OJSI tickets tracking – Jim/Pawel/Krzysztof/Amy
-CII Badging updates – first positive feedbacks -Communication matrix – ongoing exchanges with Vijay – Krzysztof’s scripts would be very helpfull (both local host and external world) -Recommended upgrades – see presentation -Nexus IQ vs. Whitesoftware
-ODL synch meeting was finally organized on 10th of October – MoM were prepared and shared with participants: 1. Dan shared the link to ONAP ODL MVP, 2. Luis will now compile the package based on MVP scope to avoid potential issues with licensing.3. Once ODL customized package is shared with ONAP (Dan), Jessica will work on preparation of Jenkins jobs with Nexus-IQ scanning, 4.Once it is done Amy will create vulnerability tables and we will organize a next call with ODL team to review findings, discuss priorities and assess whether it is ODL or upstream vulns. -What do we do with MSB or other kind of projects? – security implications…
Action with TSC was taken! List of projects with lack of reaction on security best practices to be provided. | ||
| - | Alpine recommended version | Jonathan suggested to have Alpine with JDK 11 embedded. E-mail was sent to Morgan and Brian for consultancy. | ||
Synch call with SDNC for OJSIs | It was agreed that organization of conf call should be more efficient - e-mail was sent to Dan to setup the call - waiting for his feedback. |