"The project MUST have performed a security review within the last 5 years. This review MUST consider the security requirements and security boundary." – Best Practices Badging Criterion
Please fill in the survey questions for each of the following sections. In all cases, answer the questions from the point of view for YOUR application within ONAP.
For each one, additional information on the question is available to be read by clicking the arrow following the question.
Most items in this questionnaire are related to specific Best Practices Badging Criteria. The name of the associated criterion is listed at the end of the toggled "additional information" section, along with an indication of the badging level of the question, P=passing, S=silver and G=gold.
Once the security review is completed, the application owner can update the gold level badging question "security-review" as having been accomplished.
CPS-1140 - Getting issue details... STATUS
Security Knowledge
Know Secure Design
Do the committers and PTL know how to design secure software? Do the reviewers of OJSI tickets know secure design?
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| Yes, the majority of the CPS team & PTL are aware of security best practices and are experienced in mitigation and vulnerability resolution. | +1 |
Implement Secure Design
Do the committers and PTL apply secure design principles when reviewing software for merging?
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| Yes CPS team/PTL/committers review and look for security issues and recommend fixes before merging. | +1 |
Know Common Errors
Do the committers and PTL understand commonly found errors (and how to counter or mitigate them)? Do they apply these principles when reviewing software for merging?
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| Yes, the CPS team & PTL are aware of common security risks and how to mitigate them. There are also security checks in our CI pipeline | +1 |
No Leaked Credentials
Do the committers and PTL verify that there are no non-test credentials and no non-test private keys in code to be merged?
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
We do have clear text default credentials in our docker-compose files if not provided (Only used for testing). The users of CPS are expected to override credentials and strategies around these. | +1 |
Security Documentation
Documentation Architecture
Does your project have an architecture or high level design documented?
If so, please provide a URL to the pages on wiki.onap.org or onap.readthedocs.io that have the architecture or high level design. If not, please describe the high level design here using one or more paragraphs.
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
| Yes, CPS architecture documentation can be found @ https://docs.onap.org/projects/onap-cps/en/latest/architecture.html | Note: Architecture diagram is for the Istanbul release. Please update "This page reflects the state for Istanbul-R9 release" to reflect the current release. |
Documentation Security
Does your project have a description of what a user of your project can and cannot expect in terms of security from the software produced by the project, (In other words, what are its 'security requirements'?)
If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io. If not, please describe the security requirements here using one or more paragraphs.
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
None available CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS | Please add a statement about this to the end of your architecture document (or in another wiki page), with a heading such as "CPS Security Requirements." |
Assurance Case
Does your project actually meet its documented security requirements?
If so, please provide a URL to the page(s) on wiki.onap.org or onap.readthedocs.io that describe how the project meets its security goals. If not, please describe here (using one or more paragraphs) how the project meets its security goals.
| Your Answer-Please Describe | SECCOM Feedback / Recommendations |
|---|---|
None available CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable | Please add a statement about this to the end of your security requirements section/document. At a minimum, it should indicate how you protect your username and password configurations. (See other questions on hashing of secrets and use of crypto.) comment on -logging requirements -encryption in transit (service mesh compatibility) -not running containers as 'root' |
Vulnerability Mitigation
Vulnerabilities Critical Fixed
Have you closed all issues filed against your project in sonarcloud that are CRITICAL or BLOCKERs?
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Yes, CPS sonarcloud reports can be found @ https://sonarcloud.io/organizations/onap/projects?search=cps&sort=-coverage https://sonarcloud.io/organizations/onap/projects?search=ncmp-dmi-plugin&sort=-coverage | +1 |
Vulnerabilities Fixed 60 Days
Are all vulnerabilities that are reported against your project, either through an OJSI ticket or publicly from CVE reports, fixed within two months of being reported?
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Yes. Critical vulnerabilities/issues are compiled by SECCOM periodically and CPS project team resolves them in-time for current/prev release. We also check sonarcloud reports on a weekly basis and if needed action is taken. | +1 |
Non-Cryptographic Software Questions
The following are a few issues regarding your project's software as delivered that are not cryptographic-related.
Input Validation
Does your application accept input from potentially untrusted sources? If so, do you ensure that the input is valid before processing it?
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Our application expects (any) client to upload models and data to be stored. These models and data are validated via the 3rd party tool - OpenDayLight Yang parser which is part of CPS and not a separate microservice. These are only stored once the parser accepts that it is valid and returns an exception for invalid models and data. Additionally, inputs to all REST endpoints are validated, e.g. CM handle IDs, CPS paths, timestamps | Is the ODL Yang parser included in CPS or is it a separate "microservice"? How does CPS differentiate between trusted and untrusted sources? |
Hardening
Does your project apply hardening mechanisms so that software defects are less likely to result in security vulnerabilities?
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS does not have a UI and does not use javascript The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation. Usernames and passwords are configured in .yml file of CPS for clients to configure. When CPS is run with docker, the services use username and passwords that are stored as environment variables. Testing: credentials are hardcoded Deployment: uses K8s secrets that is generated and stored as CPS is deployed | How are usernames and passwords stored? Are passwords stored hashed where CPS acts as an authenticator? |
Cryptographic-specific Software Questions
The following questions all deal with cryptographic issues.
Crypto Call – Generic
Does your software implement any cryptographic functions, such as hash functions, instead of calling on software specifically designed to implement cryptographic functions?
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| N/A |
Crypto Random - Generic
Does your software use random information? If so, does it use a cryptographically secure random number generator?
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS does generate random UUIDs for notifications. These UUIDs are generated via the built in java libraries (java.util.UUID). |
Crypto Weaknesses
Does your software depend on any cryptographic algorithms or modes that have known serious weaknesses?
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
N/A Usernames and passwords are configured in .yml file of CPS for clients to configure. When CPS is run with docker, the services use username and passwords that are stored as environment variables. Testing: credentials are hardcoded Deployment: uses K8s secrets that is generated and stored as CPS is deployed CPS relies on the java.UUID mechanism ** | [TH] how about storage of passwords? |
Crypto Working
Does your software depend on any cryptographic algorithms that are known to be broken?
| Your Answer-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
No Usernames and passwords are configured in .yml file of CPS for clients to configure. When CPS is run with docker, the services use username and passwords that are stored as environment variables. Testing: credentials are hardcoded Deployment: uses K8s secrets that is generated and stored as CPS is deployed CPS relies on the java.UUID mechanism ** | [TH] how about storage of usernames & passwords? |
Crypto Keylength
Does your software generate any keys? If so, do they use any default key-lengths that are considered insecure?
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
| CPS does not generate any keys |
Crypto Algorithm Agility
Does your software use cryptographic algorithms? If so, can a user of ONAP switch the algorithm if one is found to be broken?
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Deployment: uses K8s secrets that is generated and stored as CPS is deployed ** CPS relies on the java.UUID mechanism for generating unique identifiers | how about storage of passwords? |
Crypto Certificate Verification
Does your software use HTTPS? If so, does it do certificate verification of the host certificates by default?
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. CPS service port names has been changed to include http in name |
Crypto Credential Agility
Does your software save or process authentication credentials or private cryptographic keys? If so, is that information stored separately from other information?
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
Usernames and passwords are configured in .yml file of CPS for clients to configure. When CPS is run with docker, the services use username and passwords that are stored as environment variables. Deployment: uses K8s secrets that is generated and stored as CPS is deployed ** | [TH] how about storage of usernames and passwords for REST access? |
Crypto TLS1.2
Does your software support HTTPS? If so, is the minimum version allowed TLS1.2?
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. CPS service port names has been changed to include http in name |
Crypto Used Network
Does your software have network communications inbound or outbound? If so, do you support secure protocols for all such network communications?
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS only communicates with components within ONAP. CPS's primary communication is through HTTP. CPS uses KAFKA, and as a listener, in KAFKA we use PLAINTEXT communication, which is also KAFKA's default for communication, at a later stage the Kafka provider ( eg. Apache, Confluent, or Strimizi Kafka [which is planned to be used] ) can enable the security by default i.e the default way of communication. **CPS components are deployed within a pod, all communications in PLAINTEXT are within the pod. Any communication outside the pods is managed via the service mesh. |
Crypto Verification Private
Does your software use outbound HTTPS connections? If so, does it perform certificate verification before sending HTTP headers with private information (such as secure cookies)
| Your Answers-Please Explain | SECCOM Feedback / Recommendations |
|---|---|
CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. CPS service port names has been changed to include http in name |