2020-10-27 Security Subcommittee Meeting Notes

Honolulu non functional requirements - presentation to Requirements Subcommittee 

SECCOM requirements were presented on 26th of  October. 

• Continue packages upgrades in direct dependencies (REQ-439)

• Continue Java (REQ-438) and Python migrations (REQ-437)

• After Service Mesh PoC - new requirements might arrive.

• Harbor requirement. In Harbor:

  • you can sign the image and you can share the key with an application that has an account to pull or to push the image

  • possibility to scan the image all the time and send warning

  • Harbor deployed in run time while Whitesource and Nexus-IQ during the development.

• Logs management:

  • common place for data - all applications should generate logs that can be collected by Kubernetes (target for next release) – Honolulu requirement (REQ-441)

  • common format for data - format of minimum data that we want that is useful (target for Istambul release)

• SIEM integration (REQ-464):

  • integration like for the other applications with SIEM, have the same protocol used

  • logs from ONAP to SIEM, falco tool to be considered (IDS for Kubernetes)

  • alarms when security issue

• CII Badging: (REQ-443), Focus on Application Security questions:

  • Crypto Credentials Agility – ½ od apps in met and almost half not yet answered

  • Implement Secure Design – 1/3 of projects did not answer

  • Crypto Weaknesses – tests to be applied (3 including Morgan)

• HELMv3 migration (REQ-442)

done

Prioritization will be done by TSC.

With Fabian we made a SIEM requirement.  

CLAMP for flows documentation provided by Pierre.

It is clear for Fabian but insufficient.

ongoing

Offline exchanges to be organized next week  on (4th of November?) between Fabian and Fabien/Pierre.

Harbor integration

Requirements for Harbor to be provided to Jessica and use Jenkins sandbox.

Internal meetings to be organized by Fabian with his team and come back to SECCOM with 2 features utilization idea:

• use of Trivi to san the images

• sign the image with Notary

in standby

Java and Python upgrade

There is abuild time test that checks the images to see if they have Python 2 (interpreter) or Java 8 (runtime) included in the image. We still have lots of components that have those in their image. 

Problem statement:

It does not answer the question whether projects are using now only Python 3 and Java 11. In multiple cases people are using custom images and simply did not remove Python 2 and Java 8 as not used.

Standard image does not have old versions in it, we shall push projects to use standard image for Honolulu release and if from some reason they need to run custom image, they must remove what they do not use.

Amy will reach out Pawel W. to run some additional tests.

Synch on latest recommended versions

Some projects made a great job , some did nothing. We shall push TSC for prioritization of this task.

ongoing

CII badging requirement

Requirement to be updated.

ongoing

Tony to update Jira Epic.

CII Dashboard

3 projects that are silver now:, and even one of those projects is 65% of gold (VVP) and 2 other are at 57 % of gold (Policy) and AAF, CLAMP is 96% silver and over 40 % gold. 

ongoing

Progress was made.

SIEM requirement

To be added as it is mature:

Implementation is done to identify events that compromise the system.

This information feedback is done because only an intervention can stop this risk.

The events are logged and according to rules have intervened according to the risks.

External system must be use to save and display the log

Secure protocol  must be use to transfert the log between ONAP and external system

done

OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 3rd OF NOVEMBER'20. 

Secrets management by Natacha.