2021-01-05 Security Subcommittee Meeting Notes

SECCOM elections

Finally candidates approved by TSC:

• Amy Zwarico for SECCOM Vice Chair
• Pawel Pawlak for SECCOM Chair

Toine Siebelink new elected PTL - Configuration & Persistency Service R7

Action point from last PTL meeting - Determine what can be achieved regarding the approved best practices for the Honolulu release.

SECCOM runs mong other things:

• Software Composition Analysis with Nexus-IQ for vulnerabilities and re commended upgrades for direct dependencies.
• CII Badging (passing, silver and gold levels) - self reported. Majority of projects are at passing level.
• SonarCloud scans - used for an automated code coverage (80-90% of code). Use of various cryptography under exploration.
• Securing communication (https protocol) - tested at build time
• Removing secrets
• Not running as root

Jenkins jobs for CPS need to be revised (last time scan failed) - ticket to be opened to LFN for that.

Access to Nexus-IQ reports for Toine - ticket to be opened to LFN for that.

Under SonarCloud nearly 50% achieved so far by CPS.

Access to security vulnerability space Wiki to be organized for Toine - ticket to be opened to LFN for that.

Links for Toine:

https://jenkins.onap.org/view/CLM/job/cps-maven-clm-master/

/wiki/spaces/SV/overview

Feedback from the PTLs about the SECCOM plan on proposing that Python 2 -> 3 and Java 8 -> 11 become Honolulu Global requirements

Guilin Java upgrade results: onap-guilin-java-versions.xlsx

Guilin Python upgrade results: onap-guilin-python-versions.xlsx

Exception process is needed, PostgreSQL mentionned by Vijay. List of impacted projects requested by Seshu.