2020-11-03 Security Subcommittee Meeting Notes (under construction)

SECCOM requirements were presented on 26th of  October. 

• Continue packages upgrades in direct dependencies (REQ-439)
• Continue Java (REQ-438) and Python migrations (REQ-437)
• After Service Mesh PoC - new requirements might arrive.
• Harbor requirement. In Harbor:
  • you can sign the image and you can share the key with an application that has an account to pull or to push the image
  • possibility to scan the image all the time and send warning
  • Harbor deployed in run time while Whitesource and Nexus-IQ during the development.
• Logs management:
  • common place for data - all applications should generate logs that can be collected by Kubernetes (target for next release) – Honolulu requirement (REQ-441)
  • common format for data - format of minimum data that we want that is useful (target for Istambul release)
• SIEM integration (REQ-464):
  • integration like for the other applications with SIEM, have the same protocol used
  • logs from ONAP to SIEM, falco tool to be considered (IDS for Kubernetes)
  • alarms when security issue
• CII Badging: (REQ-443), Focus on Application Security questions:
  • Crypto Credentials Agility – ½ od apps in met and almost half not yet answered
  • Implement Secure Design – 1/3 of projects did not answer
  • Crypto Weaknesses – tests to be applied (3 including Morgan)
• HELMv3 migration (REQ-442)

Prioritization will be done by TSC.

With Fabian we made a SIEM requirement.  

CLAMP for flows documentation provided by Pierre.

Requirements for Harbor to be provided to Jessica and use Jenkins sandbox.

Internal meetings to be organized by Fabian with his team and come back to SECCOM with 2 features utilization idea:

• use of Trivi to san the images
• sign the image with Notary

There is abuild time test that checks the images to see if they have Python 2 (interpreter) or Java 8 (runtime) included in the image. We still have lots of components that have those in their image. 

Problem statement:

It does not answer the question whether projects are using now only Python 3 and Java 11. In multiple cases people are using custom images and simply did not remove Python 2 and Java 8 as not used.

Standard image does not have old versions in it, we shall push projects to use standard image for Honolulu release and if from some reason they need to run custom image, they must remove what they do not use.

To be added as it is mature:

Implementation is done to identify events that compromise the system.

This information feedback is done because only an intervention can stop this risk.

The events are logged and according to rules have intervened according to the risks.

External system must be use to save and display the log

Secure protocol  must be use to transfert the log between ONAP and external system

Secrets management by Natacha.