"The project MUST have performed a security review within the last 5 years. This review MUST consider the security requirements and security boundary." – Best Practices Badging Criteria _{[security-review G]}

Please fill in the survey questions for each of the following sections. In all cases, answer the questions from the point of view for YOUR application within ONAP.

For each one, additional information on the question is available to be read by clicking the arrow following the question.

Most items in this questionnaire are related to specific Best Practices Badging Criteria. The name of the associated criterion is listed at the end of the toggled "additional information" section, along with an indication of the badging level of the question, P=passing, S=silver and G=gold.

Once the security review is completed, the application owner can update the gold level badging question "security-review" as having been accomplished.

Security Knowledge

Know Secure Design

Do the committers and PTL know how to design secure software? Do the reviewers of OJSI tickets know secure design?

Implement Secure Design

Do the committers and PTL apply secure design principles when reviewing software for merging?

Know Common Errors

Do the committers and PTL understand commonly found errors (and how to counter or mitigate them)? Do they apply these principles when reviewing software for merging?

No Leaked Credentials

Do the committers and PTL verify that there are no non-test credentials and no non-test private keys in code to be merged?

Security Documentation

Documentation Architecture

Does your project have an architecture or high level design documented?

If so, please provide a URL to the pages on wiki.onap.org or onap.readthedocs.io  or docs.onap.org that have the architecture or high level design. If not, please describe the high level design here using one or more paragraphs.

Documentation Security

Does your project have a description of what a user of your project can and cannot expect in terms of security from the software produced by the project, (In other words, what are its 'security requirements'?)

If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io. If not, please describe the security requirements here using one or more paragraphs.

Assurance Case

Does your project actually meet its documented security requirements?

If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io that describe how the project meets its security goals. If not, please describe here (using one or more paragraphs) how the project meets its security goals.

Vulnerability Mitigation

Vulnerabilities Critical Fixed

Have you closed all issues filed against your project in sonarcloud that are CRITICAL or BLOCKERs?

Vulnerabilities Fixed 60 Days

Are all vulnerabilities that are reported against your project, either through an OJSI ticket or publicly from CVE reports, fixed within two months of being reported?

Non-Cryptographic Software Questions

The following are a few issues regarding your project's software as delivered that are not cryptographic-related.

Input Validation

Does your application accept input from potentially untrusted sources? If so, do you ensure that the input is valid before processing it?

Hardening

Does your project apply hardening mechanisms so that software defects are less likely to result in security vulnerabilities?

Cryptographic-specific Software Questions

The following questions all deal with cryptographic issues.

Crypto Call – Generic

Does your software implement any cryptographic functions, such as hash functions, instead of calling on software specifically designed to implement cryptographic functions?

Crypto Random - Generic

Does your software use random information? If so, does it use a cryptographically secure random number generator?

Crypto Weaknesses

Does your software depend on any cryptographic algorithms or modes that have known serious weaknesses?

Crypto Working

Does your software depend on any cryptographic algorithms that are known to be broken?

Crypto Keylength

Does your software generate any keys? If so, do they use any default key-lengths that are considered insecure?

Crypto Algorithm Agility

Does your software use cryptographic algorithms? If so, can a user of ONAP switch the algorithm if one is found to be broken?

Crypto Certificate Verification

Does your software use HTTPS? If so, does it do certificate verification of the host certificates by default?

Crypto Credential Agility

Does your software save or process authentication credentials or private cryptographic keys? If so, is that information stored separately from other information?

Crypto TLS1.2

Does your software support HTTPS? If so, is the minimum version allowed TLS1.2?

Crypto Used Network

Does your software have network communications inbound or outbound? If so, do you support secure protocols for all such network communications?

Crypto Verification Private

Does your software use outbound HTTPS connections? If so, does it perform certificate verification before sending HTTP headers with private information (such as secure cookies)