2023-06-13 Security Subcommittee Meeting Notes

LF IT CI/CD security review

Muddasar is not getting support for the ticket opened 1 month ago:

 IT-25429 Review of ONAP CI Threat Model and Security Controls

Pawel to check with Sandra on Wednesday's meeting.

DTF virtual event

Presentation provided by Pawel and SECCOM team to share security goals for Montreal release and latest achievements/news.

Tony participated in the road to gold presentation by CPS.

APIs in ONAP shall be well cataloguized and standards around those APIs well secured (TLS communication etc.).

We are still looking at infrastructure-as-a-code and not yet data-as-a-code.

Bob participates in Working Group 11.

User side is missing or is insufficient, while product security is more leveraged.

done

Byung to share with CPS team SECCOM Kudos for their great work done around CPS security.

CPS Road to gold 

CPS PoC under preparation – Jess is configuring 2FA for committers - done.

OJSI list communication with Jess.

5 Years security questionnaire for Policy project

-https://lf-onap.atlassian.net/wiki/display/DW/PF+-+ONAP+Security+Review+Questionnaire

strated

Pawel to check with Liam if the work is completed on Policy project side. DONE

Security review in ARCCOM

For ONAP architecture review security is part of the template.

PTL meeting (June 12th)

Presentation on new Global Requirement: Use Native Service Mesh Authentication and Authorization for Intra-ONAP Communication

• Meeting with Infosys team to be organized

Gerrit upgrade planned by Kevin right after RC milestone (after TSC meeting on Thursday)

Pawel to invite Infosys (Gnanapriya) team to OOM meeting. Andreas to be informed. DONE

TSC meeting (June 1st)

Intro provided for new Global Requirement

Badging Dashboard

Projects in unmaintained status still have active badging questionnaire

David was asked to help in marking quesionnaire as unmaintained, Tony organized meeting with David to show what needs to be done.

Latest weekly scans

Marek was able to initiate latest run of scans.

Results are progressing, cassandra and zk-tunnel-svc to be further elaborated.

Marek does not know which project is using zk-tunnel-svc - it is not in Jenkins.

ONAP-discuss question was raised but still no feedback so far.

@Robert Heinemann No references of "zk-tunnel-svc" were found in:

- https://nexus-iq.wl.linuxfoundation.org/assets/index.html#/dashboard/

- https://nexus.onap.org/

- https://nexus3.onap.org/

ongoing

Bob will try to review gerrit logs

SECCOM MEETING CALL WILL BE HELD ON 20th JUNE 2023.