Please fibd below the Minutes of Meetings and recording for the SECCOM meeting that was held on 7th of January 2020.
| Jira No | Summary | Description | Status | Solution |
|---|---|---|---|---|
ONAP - DCAE communication matrix | Meeting with Vijay done on 3rd of January. One subcomponent was missing. Steps that must be done to generate the matrix were discussed with the PTL. First step is to focus on external communication to ONAP, so we could have an exhaustive list of all the ports that must be open externally. Results would be challenged with the existing scripts ouputs. Second step is to check communication inter components. Due to complexity it will not be checked for the moment. External communication is the most exposing to some vulnerabilities. List of aliases could be easily obtained. We need to have a list of external entities, where the service is connecting. | Reverse jump host is not prevented as for the moment we have no network security policies – SECCOM should prepare best practices in this area. | To be addressed on on of the next SECCOM meetings. | |
| AAF update | Jonathan has left AT&T. | No news from John who will most probably replace Jonathan in AAF project – we need to wait for the election process and community acceptance. | ||
| CII Badging update - Tony | Tony is working on Python script. Script has an error with value update. | Tony will send a summary of answers to David, so ONAP wide answers could be unified accross projects. | ||
JDK11 update – based on PTLs call held on 6th of January | Repository under JJB to be created – Morgan is waiting for approval. From SECCOM perspective we care that standard image is used. | Alpine's alternative is Ubuntu light image - there are images that have Java 11 support. Using already available image is much better option. Waiting for Morgane's feedback. | ||
| Recent security issues opened (at the severe level) via security distribution list |
| Recommendation is to open LF Helpdesk ticket and mark with the security label. | ||
| CNTT common security interests | CNTT is focusing on infrastructure not only Openstack but also Kubernetes, other topics could be CIS benchmark for Kubernetes and Docker. In common we have requirements towards Kubernetes security. | CNTT release should be available for Kubernetes just before F2F- SECCOM should have a look on that. | ||
| Creating jira tickets based on Nexus-IQ | Work on jira python script already shared by Krzysztof. Pierre will progress in incoming weeks, as was on long holidays for last few weeks. Attention to some scripts that would not be found in Maven, so capabilities of the script might have to be enlarged to have a look at the other repositories like repository.com. Format proposed: one epic for the project and one user story for the ticket. Another proposal: every finding should have a separate ticket – easier for us to track. | |||
| Recommendations for the developers | Zygmunt started some work on guidelines it and it was followed by Harald. | Status to be reviewed on F2F. |