2020-04-14 Security Subcommittee Meeting Notes

Please find below the Minutes of Meetings and recording for the SECCOM meeting that was held on 14th of April 2020.

Jira No	Summary	Description	Status	Solution

Summary	Description	Solution
Zoom security issues	Orange team is allowed to participate in the zoom meetings but not to lead them (it woud require installation of zoom client.
Latest feedback received from Integration team	Amy made w Wiki. Some the part of docker tests need to be part of Jenkins jobs. It might be thta we will be responsible for the scripts and OOM team to get it into the place (intehrated into the Jenkins build).	Sylvain is acting PTL in OOM. For the only HTTP port exposed - action Amy – to contact PTL Bharath. - no OJSI ticket assigned as it should have appeared after our scans or component was not responding at the scanning moment. No value to open an additional tickets. MUSIC team should either: remove http, switch to https or ask for a waiver with justification.
Virtual ONAP event	SECCOM Guilin security requirements update - Paweł Holistic view of ONAP security – Krzysztof/Amy Access control Storing permission Hardening Logging Gaps identified Akraino reference for security documentation - Amy CNTT alignment meeting – to be consulted with Samuli Service Mesh – analysis and then with Architecture Subcommittee - Krzysztof Logs management evolution in ONAP - Pawel VNF security requirements - Amy Package upgrade strategy – Amy/Pawel Communication matrix - Natacha Password removal continued and no hardcoded passwords for a new code - Krzysztof NEW: CMPv2 in Guilin release – Pawel B	We should come back to Architecture Subcommittee with a proposal for Service Mesh and once approved we should apprach TSC for a recommendation.
PTLs meeting update	PTLs meeting (held on April 13th) update: -CLI closed 3 http ports and one of the CVEs and running as root -A&AI should Close 15 issues -AAF – still one issue open -Optimization – 1 running as root – under fix - submitted -MUSIC – https port exposed – delivered -Code coverage – 5 exceptions not reaching 55% (all with waiver granted: AAF no resouces for side car, Policy engine will be excluded next release, OOF – no resources) -API documentation presentation by Andy Mayer	To approach David to check who would open Jira tickets per project for package upgrades.
Scorecard for requirement req-223	David proposed to descope this requirement. Progress is minor but SECCOM porposes to keep this requirement as in scope.	Tony - to update scoorecard with green status and comment on minor but positive direction.
OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 28th OF APRIL'20 as on 21st we have vF2F meetings.