2023-05-23 Security Subcommittee Meeting Notes

SPDX 3.0 update

Muddasar provided an update on SPDX version 3 and SBOM update.

SLIDES 

Effort to move SPDX 3.0 to ISO standard still to be done.

CPS Road to gold 

Tony prepared his part of the deck for a common presentation and shared with Lee Angella.

ongoing

Tony will join next TSC and share SECCOM recommendation for 2FA.

OJSI list of people to be reviewed. Amy will contact Jess.

DTF event and SECCOM presentation

Let's have a common SECCOM voice towards ONAP community.

Slide with packages upgrades to be added as well as security template in architecture review template. 

Latest weekly scans

Marek was able to initiate latest run of scans.

Results are progressing, cassandra and zk-tunnel-svc to be further elaborated.

Marek does not know which project is using zk-tunnel-svc - it is not in Jenkins

ONAP-discuss question was raised but still no feedback so far.

ongoing

PTL meeting (May 22nd)

-PTLs upgrades for London release

2023-05-22 ONAP London release pakages upgrades.pptx - total vulns reduced significantly!

-Issue raised for images creation (Sigul signing problem) – jira ticket opened by Liam last week: https://jira.linuxfoundation.org/plugins/servlet/desk/portal/2/IT-25552

-RC blocker!

TSC meeting (May 18th)

-Review of the deck for Governance Board (presentation last week)

-2FA issue presented as summary of meeting Andreas and LF- IT last week – still some actions pending… but

-Feedback from Andy received ;-)

• 2FA can be available generally on Linux Foundation IDs and should be turned this on at the individual account level - ticket to be raised individually to LF IT.

• It can enforceed across the entire Gerrit instance if the TSC were to ratify a request that we do this and an appropriate ticket was raised on it.

• In either case, when 2FA is enabled on the account the first attempt to login via the UI after having it enabled would walk through a 2FA onboarding workflow.

• If this done by TSC mandate, then the 2FA would only affect accounts as they access Gerrit via the webUI. If an account holder wants it across _all_ of their LFID web accesses, then they would still need to talk to the support desk individually for that.

• In no case would enabling 2FA affect SSH transport to Gerrit, nor would it affect HTTPS transport to Gerrit (via the Gerrit supplied HTTPS password which is effectively a user TOKEN) as both of those transports are operating in a manner that would have required an authenticated web session for configuration before being available. This is comparable to both GitHub and GitLab 2FA solutions around git itself.

SECCOM MEETING CALL WILL BE HELD ON 30th May 2023. 

• Security review in ARCCOM