Please find below the Minutes of Meetings and recording for the SECCOM meeting that was held on 1st of March 2022.
| Jira No | Summary | Description | Status | Solution |
|---|---|---|---|---|
| IT-23622 | IT-23622 API documentation for SonarCloud (continuation of IT-23519) | New ticket was opened as old one was closed by Jess. Reference link provided by Jess points out to the deprecated API documentation. Tony provided his comment under the ticket. It seems that the new reference is for API documentation that will stop working in a few months. So it is a workaround and not ultimate solution. The replacement we should be using accroding SonarCloud requires explicit permissions to search varoius different repos to be granted to the person doing search which is not a good solution. | ongoing | |
| Log4j upgrade | Log4j status update – we recommend releasing Istanbul Maintenance release*
All related jira tickets closed:
| completed | New Ticket opened to LFN IT CLM jobs failing. | |
| IT-23650 | Unmaintained projects - Istanbul Maintenance Release Notes | Ticket creation for failing Jenkins jobs. Thomas asked to propose a patch for the composite release notes that includes info from slide 6 but we first need to solve failing Jenkins jobs. | done | Failing Jenkins jobs issue to be escalated. |
| Process for Security review question for the period of last 5 years - we move this topic to next week agenda, so Muddasar could participate. |
(1) OWASP Top 10 (2) BSIMM (3) Secure Software Development Framework This publication is a little different and is actually geared more for when selecting products and making good choices on deployment across the enterprise. However, it does bring up points that we may want to consider addressing across the architecture. (4) CIS Critical Security Controls
-Security Belts structures activities of the secure software development -https://github.com/AppSecure-nrw/security-belts -OWASP Devsecops Maturity Model -DevSecOps Platform-Independent Model: Requirements and Capabilities-SEI (FFRDC) Technical report (figure 7) -https://apps.dtic.mil/sti/pdfs/AD1152747.pdf -ISACA Cybersecurity Maturity Assessment (self-assessment) -https://www.isaca.org/enterprise/cmmi-cybermaturity-platform#cmmicp-tabs | ongoing | ONAP 5Y assessment should be a group capability assessment where we stand for the security measures that we have and how we measure it. From assessment on per each project level we will get an image of ONAP as a whole. Pawel to create criteria's proposal (kind of high level document propsoal) for futher review based on Figure 7. | |
| TSC meeting update | Log4j SECCOM recommendation for Istanbul Maintenance release presented | |||
| Security logging update | https://wiki.onap.org/display/DW/Jakarta+Best+Practice+Proposal+for+Standardized+Logging+Fields Some more clarifications planned, naming causing some confusion. | ongoing | One more session (on 25th of February) to complete fields review. Next to be reviewed with PTLs. | |
| SBOM creation - we move this topic to next week agenda | Jess had trouble with polling dependencies from some project. All CLM jenins jobs are failing now. We want to make SBOM available to end user. We are compliant to MVP for fields for SBOM. SPDX 3.0 standard will have an extended field capability (long list of optional atributes) and there will be a new ISO standard associated. | ongoing | ||
| SonarCloud findings | Tony will open direct tickets to projects. | started | Tickets to be open by Tony. | |
| LFN preparing document on ONAP security | Amy made some contributions already. Contribution needed for SBOM part – Sean to be addressed. https://wiki.lfnetworking.org/display/LN/2022+LFN+Security+whitepaper NTIA paper could be a good reference. | started | E-mai lto Sean/Bob to be sent by Amy. | |
| Badging - no update | Tony working with David and Dave on getting projects moved from having owner from project and replacing with David for Badging. Some owners gone away... Additional editors do not have rights to remove somebody from the project (can only add additional people). | |||
SECCOM MEETING CALL WILL BE HELD ON 8th OF MARCH'22. | Quality gates for code quality improvements - continuation of the discussion. 5Y review criteria. |
Recording:
SECCOM presentation: