2020-02-04 Security Subcommittee Meeting Notes

Java and the new model of licensing for Oracle JDK versus Open JDK – Natacha

Oracle JDK which is commercial - benefits updates

Open JDK - like open source so free of charge but support for java 11 but not earlier versions. 

Presentation was submitted to recent TSC meeting to ensure the common understanding of the risk. 

TSC wants to know which distribution of the OpenJDK is used – Integration team/OOM to be contacted - discussion planned for next status meeting on Wednesday. SECCOM cares Java 11 and not particular distribution - we appreciate common image from governance perspectiveand harmonization - coordination on release manager side.

Next steps:

E-mail to be sent to Morgan with Pawel B. in copy to confirm if image is already created.

Secrets management

Agreement achieved last week (Krzysztof and Samuli)

Written description is needed on the Wiki.

Once we have a written recommendation, it would be reviewed at the next SECCOM meeting and further presented at the TSC for an prroval - once gained it would become best practice.

Script for automatic jira ticket generation of direct dependencies to be upgraded was successfully tested with CLAMP by Julien and Pierre.

2 scripts were created in Python

• script 1: uses maven and creates json of direct dependencies to be upgraded

• script 2: takes json generated by script 1 and creates Jira tickets for each package to be upgraded

Scripts were reviewed as well as CLAMP. No specific feedback from SECCOM received from demo till today. 

Nexts steps: 

• Wiki with script description to be created

• Before creating a ticket script could check if it does not exist.

• Scripts available under Julien's github: https://github.com/JulienBe/onap-dep

• Present solution to PTLs and get feedback on how to integrate the scripts into the ONAP development cycle to generate the project jiras for package upgrades

New xtesting security docker has been integrated end of last week.

Meeting on Wednesday with OOM and Integration.

Update next week.

Frankfurt M2/M3 scorecard SECCOM requirements update

Items reviewed:

• REQ-207: Code coverage - project defined improvementsDone

• REQ-215: Containers configured per secure recommendationTo Do

• REQ-219: Java 11 migration from v8In Progress

• REQ-223: CII badging – meet targeted Silver and Gold requirementsDone

• REQ-227: Complete the OJSI backlogDone

• REQ-231: HTTPS communication vs. HTTP In Progress

• REQ-235: Password removal from OOM HELM charts Done

• REQ-239: Communication Matrix In Progress

• REQ-243: Kubernetes secure configuration recommendation In Progress

• REQ-247: Coverity integrationIn Progress

• REQ-251: Ingress controller In Progress

• REQ-263: Perform Software Composition Analysis - Vulnerability tablesDone

YELLOW

RED

YELLOW

RED

Default

Default

Default

Default

GREEN

RED

Default

RED

OJSI status update - projects to be reasked - if no feedback - slot to be assigned on the next PTL call

CII Badging - Jira tickets to be isued with script usage. Some answers from hardening questions.

ONES NA CFP

SECCOM presentations submitted:

• ODL and ONAP (Pawel & Luis)

• Password generation with ONAP (Krzysztof)

• Cloudnative deployment of ONAP with ingress controller (Krzysztof)

• Kubernetes and security aspects (Samuli & Amy)

To be further discussed the scope of SECCOM F2F in LA:

ONAP security requirements and allignment with VNF security requirements

VNF security requirements

CMPv2 update

Buiding containers in an unified way for ONAP

 OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 11TH OF FEBRUARY'20