2023-03-07 Security Subcommittee Meeting Notes (under construction)

Please find below the Minutes of Meetings and recording for the SECCOM meeting that was held on 7th of March 2023.

Summary	Description	Solution
Wrapping up the unmaintained repo task force	Amy presented actual status. Recap of the new process to remove repos and artifacts from the release. Identifying the candidate (no PTL), Jenkins script verifies for not updated artifact for last 12 months Investigating if it is still needed, migration path from getting supported to getting removed. Jira for ArchiCOM to be issued. Removal - remove Jenkins job that generates images for the release. Jira tickets to be created for Doc and OOM projects. Byung is working on updated architecture drawing for ONAP.	TSC to be informed on what are the components as part of the release. This could come from Docs project but earlier than at the moment of releasing.
Security Questionnaire for CPS	https://wiki.onap.org/display/DW/CPS+-+ONAP+Security+Review+Questionnaire all SECCOM comments were reviewed with CPS team. ARCHCOM LFN DTF presentation, https://wiki.lfnetworking.org/download/attachments/82904014/ONAP-ARCCOM-Update-London-2023-02-14-Final2.pptx?version=1&modificationDate=1676388390000&api=v2 - see page 6 for the security framework component	Review SECCOM feedback on 28 February call Invite CPS to 7 March SECCOM call
PTL meeting (February 27th)	Continuation of Release Management tasks review
SECCOM MEETING CALL WILL BE HELD ON 7th March 2023.	CPS Security questionnaire review by SECCOM. IT-24999 Security Issue - Sensitive information leakage Python PoC by Bob – Work in Progress – Fiachra still to be contacted Progress on package upgrades Progress on unmaintained repos

Recordings:

2023-03-07_SECCOM_week.mp4

SECCOM presentation: