2019-12-10 Security Subcommittee Meeting Notes (under construction)

Please see the Minutes of Meetings and recording for the SECCOM meeting that was held on 10th of December 2019.

Summary	Description	Status	Solution
Oparent.pom update	To ensure that Oparent.pom file has the latest references to available versions of components.	Amy updated Oparent.pom file with the latest and greatest versions available in the last week.	Warning: Jackson-mapper-asl - functionality moved to Jackson-databind with the latest version 2.10.0. For Guilin release Jackson-mapper-asl will be fully removed.
VNF security requirements	Leftovers from El Alto to be collected. Special focus on ensuring that the language is clear and definition allows for an automatic tests - fitting OVP process.	2 tickets were created from last week's call. Dealine before early spring.	We focus on testable requirements.
OOM password generation update	Passwords in ONAP should be randomly generated but it generates issues related to update of components. That is an alternative idea is considered - person deploying ONAP must provide master password- based on HMAC. If we provide the same password for deployments, the passwords generated inside ONAP will gonna be the same. For upgrade with Master passrod, ONAP passwords will not change.	Change of password done with a reliable way.	Consequences of using m,aster password - if it is compromised . See Master Password attached file.
CII Badging update – Tony	To discuss with David McBride his role in supporting CII Badging	David to be invited for the next SECCOM meeting	E-mail was sent to David. David confirm his availability on 17th of December.
ONAP access management - Natacha	User has an access to all services which is not ok		Service Mesh POC could be a solution to further investigate, amount of work with AAF could be high as an alternative.
SECCOM proposed release assessment for TSC at 12/5 meeting -KPIs CII badging – Tony Closed OJSI tickets – Krzysztof Known vulnerability management – Amy Code Coverage – Amy/Pawel -Define the passing criteria for security Frankfurt security assessment	Define the KPIs for the Frankfurt release Define the SECCOM passing criteria Owners of each KPI asked to update the KPI and passing criteria in Frankfurt security assessment		Code Coverage: Pierre proposed a Frankfurt POC with CLAMP to measure testing on core and new functionality Define core and non-core Amy will reach out to Kenny and David to set up a meeting with SONAR to learn more about the tool. SONAR reports on the percentage of new code that is covered by a test. Need the definition of New and if it is possible to define in the tool. CII badging: Tony reviewed enhancements of his CII metrics website Assurance case (documentation of project security measures) Only 10 of 38 projects have answered this question (5 Met, 5 Unmet) d Proposed that SECCOM produce a template for this case to be used by all projects Get TSC approval for template Communications Matrix pilot - Natacha working with DCAE project (Vijay)
Frankfurt security assessment (https://wiki.onap.org/display/DW/Frankfurt+Security+Assessment+Proposal)	Percentage values are proposed for each KPI.	Wiki with proposals is ready for comments	We have to book a slot at the next PTL call to present those proposals and then at the TSC call to present recommendation for approval.
Topics identified for next week's SECCOM agenda	CMPv2 status update – Pawel/Hampus CII Badging update – Tony/David ONAP and SOL004 VNF signature update – Samuli