2023-05-30 Security Subcommittee Meeting Notes
- Paweł Pawlak
Please find below the Minutes of Meetings and recording for the SECCOM meeting that was held on 30th of May 2023.
Jira No | Summary | Description | Status | Solution |
|---|---|---|---|---|
Topic suggestion from OOM | Jack shared problematic on legacy basic authentication on API communication (DCAE and AAI http communication example with fixed clear text password in configuration file in OOM). We need to look for the cases where we have some legacy authentication method in ONAP and get rid of it in favor of service mesh. Service Mesh shall take care of mutual authentication of TLS communication between ONAP components and authorization policies take care of restricting communication between components. In Montreal all ONAP components will be forced to use only service mesh, and MSB will not be available. | started | Draft presentation to be prepared by Amy with the Global Requirement and shared with ONAP community. TSC meeting to be used for making intro on the legacy basic authentication. Infosys team to be contacted for their potential contribution in Montreal release to removal of legacy basic authentication. | |
CPS Road to gold | Tony prepared his part of the deck for a common presentation and shared with Lee Anjella who shared some input as well. | ongoing | Tony will join next TSC and share SECCOM recommendation for 2FA. to be reviewed. Amy will contact Jess. | |
OJSI list of people | We started with Amy reviewing the list. In fact there are 2 lists: one for OJSI updating and the other for vulnerability disclosure. Access to OJSI Jira process clarification with Jess is ongoing. | ongoing | ||
Logging PoC | https://lf-onap.atlassian.net/wiki/pages/viewpage.action?pageId=16520434 We hope ONAP consumers will benefit from the efforts and take some next steps. | stopped | ||
DTF event and SECCOM presentation | Slide deck to be prepared by Pawel as a SECCOM voice towards ONAP community. Slide with packages upgrades to be added as well as security template in architecture review template. | started | ||
Latest weekly scans | Marek was able to initiate latest run of scans. Results are progressing, cassandra and zk-tunnel-svc to be further elaborated. Marek does not know which project is using zk-tunnel-svc - it is not in Jenkins ONAP-discuss question was raised but still no feedback so far. | ongoing | ||
PTL meeting (May 29th) | Cancelled due to day off in USA. | |||
TSC meeting (May 25th) | Tony presented SECCOM recommendation which was accepted by TSC, we run with CPS PoC for 2FA!!! | |||
SECCOM MEETING CALL WILL BE HELD ON 13th JUNE 2023. | Security review in ARCCOM |
Recordings:
SECCOM presentation:
2023-05-30 ONAP Security Meeting - AgendaAndMinutes.pptx