2021-01-05 Security Subcommittee Meeting Notes

Owned by Paweł Pawlak
Last updated: Jan 12, 2021
2 min read

Please find below the Minutes of Meetings and recording for the SECCOM meeting that was held on 5th of January 2021.

Jira No

Summary

Description

Status

Solution

Jira No

Summary

Description

Status

Solution

 

SECCOM elections

Finally candidates approved by TSC:

  • Amy Zwarico for SECCOM Vice Chair

  • Pawel Pawlak for SECCOM Chair

completed

 

 

New ONAP project intro to SECCOM

Toine Siebelink new elected PTL - Configuration & Persistency Service R7

Action point from last PTL meeting - Determine what can be achieved regarding the approved best practices for the Honolulu release.

SECCOM runs (among other things):

  • Software Composition Analysis with Nexus-IQ for vulnerabilities and re commended upgrades for direct dependencies.

  • CII Badging (passing, silver and gold levels) - self reported. Majority of projects are at passing level.

  • SonarCloud scans - used for an automated code coverage (80-90% of code). Use of various cryptography under exploration.

  • Securing communication (https protocol) - tested at build time

  • Removing secrets

  • Not running as root

Jenkins jobs for CPS need to be revised (last time scan failed) - ticket to be opened to LFN for that.

Access to Nexus-IQ reports for Toine - ticket to be opened to LFN for that.

Under SonarCloud nearly 50% achieved so far by CPS.

Access to security vulnerability space Wiki to be organized for Toine - ticket to be opened to LFN for that.

ongoing

Links for Toine:

https://jenkins.onap.org/view/CLM/job/cps-maven-clm-master/

Security Vulnerabilities Home

 

Last PTL meeting outputs

Feedback from the PTLs about the SECCOM plan on proposing that Python 2 -> 3 and Java 8 -> 11 become Honolulu Global requirements

Guilin Java upgrade results: onap-guilin-java-versions.xlsx

Guilin Python upgrade results: onap-guilin-python-versions.xlsx

Exception process is needed, PostgreSQL mentionned by Vijay. List of impacted projects requested by Seshu.

ongoing

Next step is to book the slot at the TSC (already done by Amy) to request TSC for an approval for those 2 reqs to be Honolulu Global requirements. 

 

Next ONAP events

ongoing

Please think about topics we could propose - > to be discussed next week.

 

Exception process

SECCOM does +1 or -1 and we need TSC to provide +1 or -1 before we put +2.

TSC shall approve exception.

ongoing

We need to have TSC involved in every exception.

 

OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 12th OF JANUARY'21. 

 

 

 

 

Recording:

 

SECCOM presentation: