Muddasar Ahmed (MITRE): Hey? Good morning, Bill!
Byung-Woo Jun (Ericsson Software Technology): Hey, Mooney, how are you?
Muddasar Ahmed (MITRE): Doing well.
Byung-Woo Jun (Ericsson Software Technology): yep.
Byung-Woo Jun (Ericsson Software Technology): cool down a little bit.
Muddasar Ahmed (MITRE): Yeah, it's been like 3 weeks now. My grass looks looks like I live in Texas.
Byung-Woo Jun (Ericsson Software Technology): Huh!
Muddasar Ahmed (MITRE): I bet all that the the cross is gonna die, only we's gonna be coming up now that we have couple of rains.
Byung-Woo Jun (Ericsson Software Technology): It's raining here. New Jersey.
Muddasar Ahmed (MITRE): There.
Muddasar Ahmed (MITRE): We had rain yesterday. It's supposed to rain today, too.
Byung-Woo Jun (Ericsson Software Technology): Yeah, this.
Muddasar Ahmed (MITRE): But it's it's like my observation is. It's been a couple of years
Muddasar Ahmed (MITRE): trying to build a clean grass.
Muddasar Ahmed (MITRE): One summer, when the heat comes around.
Muddasar Ahmed (MITRE): everything dies, everything is brown, but
Muddasar Ahmed (MITRE): unfortunately the weeds in crabgrass comes back up quicker than the real grass.
Byung-Woo Jun (Ericsson Software Technology): Yeah, yes, cause perfect for them, wet and then hot.
Muddasar Ahmed (MITRE): Yeah.
Muddasar Ahmed (MITRE): Morning. Patty.
Byung-Woo Jun (Ericsson Software Technology): Aye.
Byung-Woo Jun (Ericsson Software Technology): aye, Pablo.
Pawel Pawlak: Good morning, guys. I was talking to mute. Sorry.
Pawel Pawlak: Okay, let me share the screen.
Pawel Pawlak: And I think I saw some updates. So
Pawel Pawlak: let me just refresh.
Pawel Pawlak: Okay, so
Pawel Pawlak: there's just 3 of us today.
Pawel Pawlak: yeah.
Muddasar Ahmed (MITRE): Americans don't have a holiday season like your.
Pawel Pawlak: Aye.
Muddasar Ahmed (MITRE): You know they disappear for a whole August we disappear when somebody is needed.
Pawel Pawlak: Hmm
Pawel Pawlak: selection criteria.
Byung-Woo Jun (Ericsson Software Technology): Hi! Amy!
Pawel Pawlak: Hello, Amy! Good morning.
Amy Zwarico (AT&T Services, Inc.): Good morning!
Pawel Pawlak: Alright. So let's slowly start. Just a reminder, guys, that we have a policy team that is working to get their gold badge. And yesterday at the Pts call, we had some small like exchange with Ramesh. So the team is working on it.
Pawel Pawlak: And I think we have this list of people for the policy.
Pawel Pawlak: a page edition for the badging. It is completed, and all the team has already an access. So
Pawel Pawlak: just an update on this.
Pawel Pawlak: I hope
Pawel Pawlak: when Tony joins, we could have on some update from his site on this ticket that was opened a while ago.
Pawel Pawlak: and that he had some problem to merge
Pawel Pawlak: But let's move on
Pawel Pawlak: for the Vulnerability reports for Oslo.
Pawel Pawlak: As you know, reports already available.
Pawel Pawlak: and the last time we had some
Pawel Pawlak: action item
Pawel Pawlak: to remove some
Pawel Pawlak: jobs or scans from Sonar Cloud, and I've opened a ticket and received some configuration from Kevin.
Pawel Pawlak: So I think we can treat it as as done. So, I will mark it
Pawel Pawlak: just after yes,
Byung-Woo Jun (Ericsson Software Technology): Part of the in Oslo, the policy
Byung-Woo Jun (Ericsson Software Technology): Gui.
Byung-Woo Jun (Ericsson Software Technology): and then
Byung-Woo Jun (Ericsson Software Technology): so yesterday at the
Byung-Woo Jun (Ericsson Software Technology): I think you want to open another
Byung-Woo Jun (Ericsson Software Technology): ticket one time.
Pawel Pawlak: You want to have just full of policy. Gui.
Pawel Pawlak: okay, yeah.
Byung-Woo Jun (Ericsson Software Technology): Just a new new one. New one. Yeah.
Pawel Pawlak: Yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, okay, no. Problem. I, actually.
Byung-Woo Jun (Ericsson Software Technology): We approve. We approved right? Tsc. Approves. I'm I'm sure that they want to remove this from here.
Pawel Pawlak: Yeah, yeah, so.
Amy Zwarico (AT&T Services, Inc.): So could you explain that again? So
Amy Zwarico (AT&T Services, Inc.): what's happening between policy and policy? Gui.
Byung-Woo Jun (Ericsson Software Technology): Our security. Gui is not used by anybody else. So.
Amy Zwarico (AT&T Services, Inc.): So you're removing it.
Byung-Woo Jun (Ericsson Software Technology): Yeah, they are the, you know, Alex and the Ramesh honest team, they said, no longer need it. So they
Byung-Woo Jun (Ericsson Software Technology): requested, and in the oem, and we checked the dependency. Only policy, parent rarely using it. So that means we is safe to demove it. So Tsc, last week Thursday Tsc. Voted to remove the defecate policy. Gui. So that means you will be gone. The janky? I asked Ramesh, which is Ptl. Who is Ptr. To
Byung-Woo Jun (Ericsson Software Technology): request to a Jenkins shall be move, and then others, and then this one, I think the public can issue tickets. Fid.
Pawel Pawlak: Hmm, yeah. Great.
Pawel Pawlak: Let me add my action for myself, just just for
Pawel Pawlak: ensuring that I would not forget.
Pawel Pawlak: So I will add, maybe.
Pawel Pawlak: remove
Pawel Pawlak: policy, Gui.
Pawel Pawlak: But this is for both
Pawel Pawlak: similar cloud and drinking jobs for Clm. Scouts. Right?
Byung-Woo Jun (Ericsson Software Technology): Yeah. Yeah.
Byung-Woo Jun (Ericsson Software Technology): Crm, oh, like, like, you know, those. Yeah.
Byung-Woo Jun (Ericsson Software Technology): And Jenkin. I asked Ramesh to create ticket.
Pawel Pawlak: You. You are okay. So I will just request for this on our cloud, right not to request. Say twice. Same right.
Byung-Woo Jun (Ericsson Software Technology): Crm scan is part of a Jenkin.
Pawel Pawlak: Yes.
Byung-Woo Jun (Ericsson Software Technology): Okay.
Pawel Pawlak: For the nexus IQ. Right?
Pawel Pawlak: Alright, I will. I will. Just
Pawel Pawlak: summary cloud reports
Pawel Pawlak: indicate.
Pawel Pawlak: Okay.
Pawel Pawlak: thank you.
Pawel Pawlak: So we have this one item. When we discuss with Amy on Friday
Pawel Pawlak: about updating Java, Java python always databases, releases versions. An update Amy on your site.
Amy Zwarico (AT&T Services, Inc.): No, no update on this the other one is that I did commit to getting to creating
Amy Zwarico (AT&T Services, Inc.): Jira tickets for the package upgrades.
Pawel Pawlak: Oh, yeah, yeah, indeed.
Pawel Pawlak: Okay.
Pawel Pawlak: Moving forward. I'm just Ras, last last reminder about this Sisa.
Pawel Pawlak: You know, memory unsafe languages. So this is informative meaning for us.
Pawel Pawlak: and we had some exchanges.
Pawel Pawlak: Hmm
Pawel Pawlak: on it already.
Pawel Pawlak: and the second, we had some updated the Tsc.
Pawel Pawlak: We had some updated the Ptls. So
Pawel Pawlak: just to to keep in mind that, you know.
Pawel Pawlak: if you want to keep some. I know performance. Then
Pawel Pawlak: some some selection of the languages
Pawel Pawlak: was done for a reason, right? And
Pawel Pawlak: and so we will not change
Pawel Pawlak: everything in on up.
Pawel Pawlak: just because it is unsafe.
Pawel Pawlak: But it's worth to know right. And you know, when you consider.
Pawel Pawlak: you know, running some new project, or.
Pawel Pawlak: you know, making some, some updates and you have resources, then
Pawel Pawlak: it's worth to know, to take it into consideration.
Pawel Pawlak: One more aspect
Pawel Pawlak: of
Pawel Pawlak: of of.
Byung-Woo Jun (Ericsson Software Technology): 1. 1 information is Om team Andrews guys. So I discussed about this, and, as Emmy said.
Byung-Woo Jun (Ericsson Software Technology): envoy proxy was written C and C plus plus, and then but fortunately, control plane was cool. So that means, if we use M. Ambient mesh, that means we not. We don't have to use
Byung-Woo Jun (Ericsson Software Technology): and with Foxy
Byung-Woo Jun (Ericsson Software Technology): I mean, the Deutsch telecom is checking, but not sure when they're gonna do it. But they says, you know, since
Byung-Woo Jun (Ericsson Software Technology): Csi at Cisa. I recommended, maybe maybe it's 1 of the good reason
Byung-Woo Jun (Ericsson Software Technology): to remove android proxy. So. But that was the discussion. But I don't know when they're gonna do it.
Byung-Woo Jun (Ericsson Software Technology): It's information.
Pawel Pawlak: Okay, okay, thank you for sharing
Pawel Pawlak: alright. So I already
Pawel Pawlak: removed some information just not to spend time on it. Just a reminder as a regular reminder. Okay, as normal as Bob Rama in September. So if you're interested, please register.
Byung-Woo Jun (Ericsson Software Technology): Anybody going there? Anybody?
Byung-Woo Jun (Ericsson Software Technology): Yes, bum.
Pawel Pawlak: I I registered for remote participation for the 1st day.
Pawel Pawlak: not sure if I would have a budget to.
Pawel Pawlak: I mean.
Byung-Woo Jun (Ericsson Software Technology): Yeah. He was.
Pawel Pawlak: Join physically, but
Pawel Pawlak: for the moment don't plan to do it. But who knows.
Byung-Woo Jun (Ericsson Software Technology): Maggie Modesta. I don't know anybody going.
Maggie Cogdell: I'll have to look at it.
Byung-Woo Jun (Ericsson Software Technology): Okay. I'm just curious.
Byung-Woo Jun (Ericsson Software Technology): Well.
Pawel Pawlak: We hope?
Pawel Pawlak: No, no, no, this is
Pawel Pawlak: I think it's in us somewhere.
Byung-Woo Jun (Ericsson Software Technology): Us, Denver, Denver, Colorado.
Pawel Pawlak: Well, probably nice place to be there.
Pawel Pawlak: Ever been there. But
Pawel Pawlak: yeah.
Maggie Cogdell: Hmm! Oh, good!
Pawel Pawlak: Reason to to, to join, for sure.
Pawel Pawlak: Let let's see, let's see a new view. You you consider.
Byung-Woo Jun (Ericsson Software Technology): Yeah. But you know, I I plan to.
Byung-Woo Jun (Ericsson Software Technology): During the September 1618.
Pawel Pawlak: In, the.
Byung-Woo Jun (Ericsson Software Technology): So this is, you know, back to back.
Maggie Cogdell: Yeah.
Byung-Woo Jun (Ericsson Software Technology): I'm I'm not sure so.
Pawel Pawlak: Hard.
Byung-Woo Jun (Ericsson Software Technology): Yeah, we see.
Pawel Pawlak: Okay. Okay, okay. Hmm.
Pawel Pawlak: I remove some items for the packages, upgrades for the new Delhi.
Pawel Pawlak: I think that the we we already.
Pawel Pawlak: you know, delivered new daddy. So probably this this items, although I asked the question, I did not get an answer right. But
Pawel Pawlak: probably those items items are not valid anymore.
Pawel Pawlak: But I'm not removing them completely, just
Pawel Pawlak: just to double check if something they should be still follow up or or not.
Pawel Pawlak: So yes, the action to share with the ptls was done, and and view most open tickets.
Byung-Woo Jun (Ericsson Software Technology): This is done, ticket is done.
Pawel Pawlak: Yeah, yeah, yeah, both are done. Right?
Pawel Pawlak: For the login modification proposal. Okay, we are in Oslo. So maybe soon, matios and enter the communication team.
Pawel Pawlak: Yeah, you need to come back to us.
Byung-Woo Jun (Ericsson Software Technology): Last last Wednesday I had a meeting with the Tata at the Om. But they said they still have plan.
Byung-Woo Jun (Ericsson Software Technology): but no detail plan yet, but he said he, were they plan to do it?
Pawel Pawlak: Okay, okay, thank you
Pawel Pawlak: for the Githap actions. Integration.
Pawel Pawlak: I think that this is, let's say, ongoing. Recently there was a migration of the of the wikis.
Pawel Pawlak: and the
Pawel Pawlak: it seems to be
Pawel Pawlak: pretty problematic that the amount of data to be migrated was
Pawel Pawlak: too high, too too
Pawel Pawlak: too much things to to go to to move.
Pawel Pawlak: Hmm, so yeah, let's see
Pawel Pawlak: how is going to be completed. And when exactly the Github actions are going to be
Pawel Pawlak: implemented, I think it's still valid for this year, but
Pawel Pawlak: no exact date, I think.
Pawel Pawlak: for the elephant, a Ml. I moved to some of the information and left some last remindings
Pawel Pawlak: about China, mobile China telecom.
Pawel Pawlak: I guess there is no nothing more to add, as of today, right.
Byung-Woo Jun (Ericsson Software Technology): They? Yeah, they plan to have a review architecture impact by end of the this month or early next month. That's the new plan.
Byung-Woo Jun (Ericsson Software Technology): So they are cool.
Pawel Pawlak: Okay. So by beginning.
Byung-Woo Jun (Ericsson Software Technology): At. Yeah, by the beginning of the August.
Byung-Woo Jun (Ericsson Software Technology): I think the boss company will presents their
Byung-Woo Jun (Ericsson Software Technology): feature.
Byung-Woo Jun (Ericsson Software Technology): In for Oslo, so.
Pawel Pawlak: Okay.
Pawel Pawlak: I wouldn't.
Pawel Pawlak: We'll keep it
Pawel Pawlak: here.
Pawel Pawlak: Me unbound here.
Pawel Pawlak: Okay, Nefia security working group and then update.
Byung-Woo Jun (Ericsson Software Technology): They postponed the second demo. But the most likely this week they gonna show. So I just.
Pawel Pawlak: Okay. So expected this week is valid. Still, right?
Byung-Woo Jun (Ericsson Software Technology): Yeah.
Pawel Pawlak: I will! I will not.
Byung-Woo Jun (Ericsson Software Technology): You know that thing.
Pawel Pawlak: Okay, hmm.
Pawel Pawlak: okay. And we already discussed about this. So I would not. Okay, ambient mesh under consideration.
Pawel Pawlak: Maybe I will add, if stable. And
Pawel Pawlak: as you mentioned being right, that it's not only stability, but but also
Pawel Pawlak: efficiency, right how to call it.
Byung-Woo Jun (Ericsson Software Technology): Yes.
Pawel Pawlak: And memory is safe. Right?
Byung-Woo Jun (Ericsson Software Technology): And what do you say?
Pawel Pawlak: Cookie
Pawel Pawlak: for the Tc. That was held last Thursday.
Pawel Pawlak: I already mentioned about this tickets removing our cloud reports. This is done.
Pawel Pawlak: There was also
Pawel Pawlak: information
Pawel Pawlak: that Po performed the the activity to
Pawel Pawlak: to add memory save good guidance.
Pawel Pawlak: Maybe beyond. You would like to.
Byung-Woo Jun (Ericsson Software Technology): Modesto. Last time Modesta asked us. Ask me to add into here so part of the owner component of to review template
Byung-Woo Jun (Ericsson Software Technology): they have a section for the free section, I added. They have to, you know. Consider memory save code guidance. That's the one addition. And then we already told this to PTL,
Byung-Woo Jun (Ericsson Software Technology): hmm.
Byung-Woo Jun (Ericsson Software Technology): but yeah, that's the mode. That's also request. Yeah.
Pawel Pawlak: And Tsc. Voted policy Gui application. So you have this information here?
Pawel Pawlak: Hmm, for the Ptl. Score.
Byung-Woo Jun (Ericsson Software Technology): DM, Fdr. Is a new thing. We are plan, we are. We? We plan to remove it in Oslo. So that means, after Emma's gone.
Byung-Woo Jun (Ericsson Software Technology): and whole email will be disappear.
Byung-Woo Jun (Ericsson Software Technology): So the Andrews guy so will check to. He checked the the dependency last time, but he will double check any other dependency for dia. So after this we, since there's no Pto, and then I issue ticket for this. Yeah, you know the application. And then, once
Byung-Woo Jun (Ericsson Software Technology): Andrews review his the dependency again. Then we can remove this one. A whole email will be gone in
Byung-Woo Jun (Ericsson Software Technology): from Alison.
Amy Zwarico (AT&T Services, Inc.): Oh, yeah, because data router is the only one left, isn't it?
Amy Zwarico (AT&T Services, Inc.): Yeah.
Byung-Woo Jun (Ericsson Software Technology): Excuse me.
Amy Zwarico (AT&T Services, Inc.): Data. Router is the only part of Dmap left.
Byung-Woo Jun (Ericsson Software Technology): Yes, Andrew.
Amy Zwarico (AT&T Services, Inc.): So that'd be great if we can.
Amy Zwarico (AT&T Services, Inc.): That one's always been.
Byung-Woo Jun (Ericsson Software Technology): Yes.
Amy Zwarico (AT&T Services, Inc.): I've always wondered why it was there, but you know.
Byung-Woo Jun (Ericsson Software Technology): The he said. The last time. Dca, one odd they're using it, but the not much anymore. So that's why Andrew thing, I say, but he will
Byung-Woo Jun (Ericsson Software Technology): double check.
Byung-Woo Jun (Ericsson Software Technology): Yeah, it's good thing we can.
Maggie Cogdell: So that's being replaced by some other things. Right?
Maggie Cogdell: It got replaced by.
Amy Zwarico (AT&T Services, Inc.): Kafka right.
Byung-Woo Jun (Ericsson Software Technology): Yeah. Kafka stream. G, yeah. So.
Maggie Cogdell: And come.
Maggie Cogdell: Yep.
Amy Zwarico (AT&T Services, Inc.): Bottom line instead of writing their instead of having a custom, one just use one. Just use a
Amy Zwarico (AT&T Services, Inc.): data router and and all the things that the
Amy Zwarico (AT&T Services, Inc.): the the platform did, that you can find that other people do
Amy Zwarico (AT&T Services, Inc.): full time. So
Amy Zwarico (AT&T Services, Inc.): map.
Pawel Pawlak: And year.
Amy Zwarico (AT&T Services, Inc.): Sort of. So, you know.
Pawel Pawlak: I don't know.
Amy Zwarico (AT&T Services, Inc.): Yeah. In the 1st place.
Pawel Pawlak: Yeah, yeah, that's okay. Somebody had some contribution in the past, right? Wanted to
Pawel Pawlak: to develop something, and and you know.
Pawel Pawlak: bring some some value. But.
Maggie Cogdell: Times, change.
Pawel Pawlak: If, yeah, yeah, yeah.
Pawel Pawlak: Okay. So coming back to the the Ptls call.
Pawel Pawlak: hmm.
Pawel Pawlak: we have this open removal activity, right?
Pawel Pawlak: And we plan to have some
Pawel Pawlak: recheck with Dan.
Pawel Pawlak: and address is going to be. He's going to write an email, or maybe he did already.
Pawel Pawlak: To Dan, so we could check with him. What is the plan and what we can we can
Pawel Pawlak: try to do in in the Oslo timeline.
Pawel Pawlak: Yeah, with the Rfc. 80 40,
Pawel Pawlak: you know, migration
Pawel Pawlak: compliance.
Pawel Pawlak: Let's call it this way. So
Pawel Pawlak: we try to to to touch base with Dan and and get feedback from his site.
Pawel Pawlak: A
Pawel Pawlak: elephant duck.
Pawel Pawlak: I think there was a meeting that we could have some updates right on.
Pawel Pawlak: Is there anything interesting? That?
Pawel Pawlak: So yeah, so voting, voting, yeah, voting, ongoing.
Amy Zwarico (AT&T Services, Inc.): Did we ever wind up? Did we ever wind up voting on anything at that meeting? Mutasler? It seemed like we just talked about it would be. You know.
Amy Zwarico (AT&T Services, Inc.): it would be a good idea. But nobody
Amy Zwarico (AT&T Services, Inc.): was there a resolution I didn't feel like there was one.
Muddasar Ahmed (MITRE): So there were couple of things we talked. One was security, right? Security.
Muddasar Ahmed (MITRE): and pretty much. The agreement was.
Muddasar Ahmed (MITRE): yes, that's the great idea. We can use
Muddasar Ahmed (MITRE): the Kpis in prod
Muddasar Ahmed (MITRE): project.
Muddasar Ahmed (MITRE): what's called project promotion or
Muddasar Ahmed (MITRE): and we'll health check
Muddasar Ahmed (MITRE): annual health check discussions, for every project Tech can use that to enforce quality and security goals.
Muddasar Ahmed (MITRE): And the homework was that we all need to come up with.
Muddasar Ahmed (MITRE): What are those kpis that must be checked.
Muddasar Ahmed (MITRE): And what are the thresholds?
Muddasar Ahmed (MITRE): So there's no resistance that I think everybody agreed. Got some feedback, too.
Muddasar Ahmed (MITRE): There are some other stuff. For example.
Muddasar Ahmed (MITRE): the chair and vice chair election. That's coming up.
Muddasar Ahmed (MITRE): Yeah.
Muddasar Ahmed (MITRE): that 2 seeds
Muddasar Ahmed (MITRE): security seat. And
Muddasar Ahmed (MITRE): what was that? The super blueprint seat.
Muddasar Ahmed (MITRE): those have to be
Muddasar Ahmed (MITRE): reconfirmed.
Muddasar Ahmed (MITRE): And the there was an idea about
Muddasar Ahmed (MITRE): replacing super blueprint
Muddasar Ahmed (MITRE): with AI,
Muddasar Ahmed (MITRE): because these 2 additional seats are so, every project gets a seat on Tac.
Muddasar Ahmed (MITRE): but these 2 seats were augmented.
Muddasar Ahmed (MITRE): and since super blueprint is applying for a project status, they will get their own seed.
Muddasar Ahmed (MITRE): and the idea was super blueprint. Augmented seat
Muddasar Ahmed (MITRE): can be given to AI task force.
Muddasar Ahmed (MITRE): So main thing for us is really the
Muddasar Ahmed (MITRE): the selecting the Kpis and then selecting the tools
Muddasar Ahmed (MITRE): that will collect that data. So it's not a lot of labor intensive process
Muddasar Ahmed (MITRE): or subjective to
Muddasar Ahmed (MITRE): the tag member or Tscs or representative from different projects.
Muddasar Ahmed (MITRE): to just decide
Muddasar Ahmed (MITRE): how they are meeting those.
Pawel Pawlak: Okay.
Muddasar Ahmed (MITRE): So we we do have some kpis. I think the the framework that Tony created does help.
Muddasar Ahmed (MITRE): We just need to figure out that, are we doing a good job on creating a comprehensive list? That
Muddasar Ahmed (MITRE): should be part of consideration? And then, second step would be, how can that data be automated.
Muddasar Ahmed (MITRE): So this is a, you know, sort of transparent process for everybody. There could be dashboards.
Muddasar Ahmed (MITRE): That rely on the data coming out of the projects.
Muddasar Ahmed (MITRE): so that it's
Muddasar Ahmed (MITRE): fair thing for users, and fair thing for governance.
Amy Zwarico (AT&T Services, Inc.): Well, I'm looking, you know.
Amy Zwarico (AT&T Services, Inc.): one of the things I am. Can one of the things that they bring up and
Amy Zwarico (AT&T Services, Inc.): is.
Amy Zwarico (AT&T Services, Inc.): you know, you can. There are different tools you can use.
Amy Zwarico (AT&T Services, Inc.): and that will make the Kpis just a nuisance to collect if different projects are using different tooling.
Amy Zwarico (AT&T Services, Inc.): at least on security, because, you know, we can.
Amy Zwarico (AT&T Services, Inc.): I think we could all quickly agree on some basic kpis for secure for security, because it it really does come down to?
Amy Zwarico (AT&T Services, Inc.): Are you
Amy Zwarico (AT&T Services, Inc.): to me? The Kpi is, are you maintaining your code? Are you fixing security vulnerabilities?
Amy Zwarico (AT&T Services, Inc.): If every project is selecting different different tooling to use. Then
Amy Zwarico (AT&T Services, Inc.): your Kpis are going to have any automated Kpi is going to have. It's going to be a lot of work
Amy Zwarico (AT&T Services, Inc.): because you're going to have to have interfaces to anything.
Amy Zwarico (AT&T Services, Inc.): And so I think that that's that's the complicating factor of the Kpis
Amy Zwarico (AT&T Services, Inc.): is is the Linux is the elephant Tac. Willing to say.
Amy Zwarico (AT&T Services, Inc.): Do whatever you like.
Amy Zwarico (AT&T Services, Inc.): but for the purposes of your kpis we're going to pull front. We're going to run your code through these particular.
Amy Zwarico (AT&T Services, Inc.): This is the set of tools for reviews.
Amy Zwarico (AT&T Services, Inc.): Pick your favorite ones, and you know a sca tool and a sas tool, say.
Amy Zwarico (AT&T Services, Inc.): and
Amy Zwarico (AT&T Services, Inc.): so the the projects have to do that, and then we we will know what the Kpis are.
Amy Zwarico (AT&T Services, Inc.): Otherwise I just don't really see how we have it automated. And does elephant Tac have the
Amy Zwarico (AT&T Services, Inc.): the people who are willing to do to pull kpis from all different tools
Amy Zwarico (AT&T Services, Inc.): either way works for me. I I just don't know
Amy Zwarico (AT&T Services, Inc.): where we're gonna get. I don't know that we're gonna get the does elephant tech have the
Amy Zwarico (AT&T Services, Inc.): the support
Amy Zwarico (AT&T Services, Inc.): to pull from multiple different tools.
Muddasar Ahmed (MITRE): I think those are the challenges. We'll try to resolve right if we can come up with
Muddasar Ahmed (MITRE): and, agreed.
Muddasar Ahmed (MITRE): Kpi list that provides intelligence and insight about the maturity of the
Muddasar Ahmed (MITRE): of the project in reference to quality and security implementation.
Muddasar Ahmed (MITRE): Then we can figure out where we have holes and try to fill those holes.
Muddasar Ahmed (MITRE): Thing it
Muddasar Ahmed (MITRE): to me. It's important that we take that journey. We start
Muddasar Ahmed (MITRE): and we'll figure out all the
Muddasar Ahmed (MITRE): hurdles and how to remove them later on.
Amy Zwarico (AT&T Services, Inc.): Okay?
Amy Zwarico (AT&T Services, Inc.): Because I do think that to me for starters is just.
Amy Zwarico (AT&T Services, Inc.): are you updating packages?
Amy Zwarico (AT&T Services, Inc.): Are you fixing bones in your own code?
Amy Zwarico (AT&T Services, Inc.): I think those are probably the 2 most important things to have
Amy Zwarico (AT&T Services, Inc.): and to consider.
Muddasar Ahmed (MITRE): And I think we can use that 5 year assessment that we did. I think
Muddasar Ahmed (MITRE): there was a lot of material in there that really goes to the crux of it. How well the project is doing on those things.
Amy Zwarico (AT&T Services, Inc.): Right.
Muddasar Ahmed (MITRE): We can convert some of those. See where we can figure out right what tool may be required. Right? Generally, if everybody's using Jira.
Muddasar Ahmed (MITRE): yeah, we could get something out of it. If everybody's using github action, we can get something out of it. So we just need to figure out
Muddasar Ahmed (MITRE): is some of that topic area measurable
Muddasar Ahmed (MITRE): that we used in 5 year assessment.
Muddasar Ahmed (MITRE): And what will be those measurements? Because we, at least in our assessment Review, we allowed subjective answers, and we interviewed
Muddasar Ahmed (MITRE): would like to see if
Muddasar Ahmed (MITRE): some of those can be converted to measurements.
Muddasar Ahmed (MITRE): and then we'll figure out
Muddasar Ahmed (MITRE): what would be the tool to track those measurements.
Amy Zwarico (AT&T Services, Inc.): That sounds like a good path forward. Thanks, thanks, Madison.
Muddasar Ahmed (MITRE): So we'll we'll update I guess a lot of the work is gonna be here because.
Muddasar Ahmed (MITRE): did not see people volunteering. People are curious people are interested in tech.
Muddasar Ahmed (MITRE): But
Muddasar Ahmed (MITRE): there wasn't like Oh, you can reach out to me. There was, I think, only one or 2 people who really thought it's great idea they can contribute towards it.
Muddasar Ahmed (MITRE): but seems like the body is more suited for.
Muddasar Ahmed (MITRE): Bring an idea to the table and let them criticize it
Muddasar Ahmed (MITRE): and approve it.
Muddasar Ahmed (MITRE): The most people who attend those
Muddasar Ahmed (MITRE): don't take the homework home.
Amy Zwarico (AT&T Services, Inc.): No, they do not. I'm probably one of those who doesn't take much of the
Amy Zwarico (AT&T Services, Inc.): occasionally I do homework there, but you know.
Muddasar Ahmed (MITRE): So we'll try to put something as a starter.
Amy Zwarico (AT&T Services, Inc.): Okay.
Muddasar Ahmed (MITRE): And that way.
Muddasar Ahmed (MITRE): you know, we can work with them the kind of time they have or maybe the kind of stuff they like to do
Muddasar Ahmed (MITRE): and improve from there.
Amy Zwarico (AT&T Services, Inc.): Okay, I like that approach forward.
Amy Zwarico (AT&T Services, Inc.): so you're talking about Tony's 5 year assessment that we put together in Seccom right?
Muddasar Ahmed (MITRE): Yeah. So his dashboard.
Maggie Cogdell: Like.
Muddasar Ahmed (MITRE): Assessment.
Muddasar Ahmed (MITRE): And then, you know, sort of create. Collect this information.
Muddasar Ahmed (MITRE): and this information allows you to assess XYZ. Aspects of the maturity right.
Amy Zwarico (AT&T Services, Inc.): So. And in fact, that's a very nice, I
Amy Zwarico (AT&T Services, Inc.): you know. Thank you. To Tony, who does a ton of homework.
Amy Zwarico (AT&T Services, Inc.): that's a great
Amy Zwarico (AT&T Services, Inc.): that is, I think that's actually a really good
Amy Zwarico (AT&T Services, Inc.): process to use to decide is the project ready to move
Amy Zwarico (AT&T Services, Inc.): between
Amy Zwarico (AT&T Services, Inc.): between different life cycle stages, and that means both backwards and forwards.
Amy Zwarico (AT&T Services, Inc.): maybe we can just
Amy Zwarico (AT&T Services, Inc.): pick what we think looks sensible, for
Amy Zwarico (AT&T Services, Inc.): you know you're in incubation. You're in
Amy Zwarico (AT&T Services, Inc.): whatever this. I never remember what all their things are, you know, mature incubation, depricated
Amy Zwarico (AT&T Services, Inc.): and just pick things that we think that if you're at this point.
Amy Zwarico (AT&T Services, Inc.): you know you may not be applying, but you're.
Amy Zwarico (AT&T Services, Inc.): you know, you may be moving. It's possible you're moving backwards, because that's the one I always worry about is that
Amy Zwarico (AT&T Services, Inc.): nobody really likes to talk about the
Amy Zwarico (AT&T Services, Inc.): this code is really not ready to be. This code isn't should not really be used any longer.
Amy Zwarico (AT&T Services, Inc.): because if something goes wrong, there's no one to fix it.
Muddasar Ahmed (MITRE): Yep.
Amy Zwarico (AT&T Services, Inc.): So we shouldn't be advocating for it. We shouldn't be advertising it
Amy Zwarico (AT&T Services, Inc.): as an as a as a responsible party doesn't mean that you you pull it off and make it not available to somebody, because there's probably really good ideas in it that somebody
Amy Zwarico (AT&T Services, Inc.): may well be willing to take on themselves.
Amy Zwarico (AT&T Services, Inc.): but
Amy Zwarico (AT&T Services, Inc.): promoting the code as something people should be using
Amy Zwarico (AT&T Services, Inc.): is irresponsible in many cases.
Pawel Pawlak: True.
Muddasar Ahmed (MITRE): So I think that's the the main idea behind it, right?
Muddasar Ahmed (MITRE): That there's some projects where there's so much due diligence and to name, like, you know, the open stack, the the Kubernetes
Muddasar Ahmed (MITRE): and Linux kernel and stuff.
Muddasar Ahmed (MITRE): There's there's a lot of eyes
Muddasar Ahmed (MITRE): enhancing walls.
Muddasar Ahmed (MITRE): Do they get.
Muddasar Ahmed (MITRE): you know, good product out. And then there's a lot of feedback in that community
Muddasar Ahmed (MITRE): where the product can be improved.
Muddasar Ahmed (MITRE): but not having a process in government.
Muddasar Ahmed (MITRE): puts other projects at disadvantage because they they're not enjoying Sam same kind of participation from the user community.
Muddasar Ahmed (MITRE): You know, it's much easier.
Amy Zwarico (AT&T Services, Inc.): Thing, about.
Muddasar Ahmed (MITRE): If there are products out of the open source project
Muddasar Ahmed (MITRE): that creates a professional feedback
Muddasar Ahmed (MITRE): pipeline
Muddasar Ahmed (MITRE): that goes back to the project through the product, commercial product funnel
Muddasar Ahmed (MITRE): and the Kubernetes. And a lot of these stuff is kind of enjoying that. But for other projects that don't have a products in the marketplace that rely on the open source code.
Maggie Cogdell: Yeah.
Muddasar Ahmed (MITRE): We don't have
Muddasar Ahmed (MITRE): account teams. We don't have marketing exactly all that stuff.
Muddasar Ahmed (MITRE): we will say. Oh, this doesn't work. And all this belongs to this component of open source code. They'll go back. And you know that works very well.
Muddasar Ahmed (MITRE): So we need to augment that through some
Muddasar Ahmed (MITRE): self-governance process where.
Muddasar Ahmed (MITRE): At least we can keep what's in our control.
Muddasar Ahmed (MITRE): Updated.
Amy Zwarico (AT&T Services, Inc.): Exactly. And I think that you know the difference with
Amy Zwarico (AT&T Services, Inc.): Linux, with Kubernetes. Those are.
Amy Zwarico (AT&T Services, Inc.): Those are those are. That's software that is widely used across every single industry out there.
Amy Zwarico (AT&T Services, Inc.): Lfn is really, for for all practical purposes, it it's a very niche.
Amy Zwarico (AT&T Services, Inc.): It's very niche. It's
Amy Zwarico (AT&T Services, Inc.): a small number of
Amy Zwarico (AT&T Services, Inc.): it's really a small number of companies that
Amy Zwarico (AT&T Services, Inc.): are in kind of you know the Telco or in the Telcos, the telecommunications space. I'll make it a little broader than just telco.
Amy Zwarico (AT&T Services, Inc.): that is honestly a niche market.
Amy Zwarico (AT&T Services, Inc.): It's more difficult to find that you don't have as many organizations that are willing to step up and do something and support both a commercial product
Amy Zwarico (AT&T Services, Inc.): and an open source product.
Amy Zwarico (AT&T Services, Inc.): So I think that's 1 of the things that makes it more difficult in elephant.
Amy Zwarico (AT&T Services, Inc.): but
Amy Zwarico (AT&T Services, Inc.): it's just philosophical. I like the approach of looking at Tony's 5 year assessment
Amy Zwarico (AT&T Services, Inc.): and
Amy Zwarico (AT&T Services, Inc.): deciding
Amy Zwarico (AT&T Services, Inc.): at what point do you you know? What do you have to pass to be the various stages.
Amy Zwarico (AT&T Services, Inc.): and to remain in in various stages?
Amy Zwarico (AT&T Services, Inc.): And I think that's a really good.
Amy Zwarico (AT&T Services, Inc.): So we can bring that to the to the tech
Amy Zwarico (AT&T Services, Inc.): as a proposal, because maybe then they'll just agree with it. And then you're right.
Amy Zwarico (AT&T Services, Inc.): Maybe the 1st step is to decide at a high level what we want to do, and then figure out, where do you start collecting reliable data?
Amy Zwarico (AT&T Services, Inc.): So thanks for the Sir.
Pawel Pawlak: All right.
Pawel Pawlak: So let me check if we have some
Pawel Pawlak: additional items. Yes, so about the quality goals.
Pawel Pawlak: So this is related right?
Muddasar Ahmed (MITRE): Yeah, I think we could.
Pawel Pawlak: That we discussed
Pawel Pawlak: lack of serum scans for Md, portal, I think this is still
Pawel Pawlak: for the Ui still valid
Pawel Pawlak: and fit although he's backing from from holidays. But
Pawel Pawlak: he needs to have some offline exchange with Jessica or Kevin.
Pawel Pawlak: Just a reminder about upcoming security events. We're being plan plans to join in the end.
Pawel Pawlak: And our next meeting would would be next week same time.
Pawel Pawlak: So can we address today some additional topics.
Byung-Woo Jun (Ericsson Software Technology): Modesta, send me. Send us the use case.
Pawel Pawlak: There are some links right.
Muddasar Ahmed (MITRE): Yeah, so I I, this is something.
Muddasar Ahmed (MITRE): I've been looking at the the workload identity.
Muddasar Ahmed (MITRE): and then kind of thinking, you know.
Muddasar Ahmed (MITRE): there is a proposal on the Orn Alliance
Muddasar Ahmed (MITRE): to leverage workload identity.
Muddasar Ahmed (MITRE): And the one thing that I was missing
Muddasar Ahmed (MITRE): is that okay? So what if you have an identity.
Muddasar Ahmed (MITRE): The only
Muddasar Ahmed (MITRE): straight away benefit out of the spiffy framework was, you get the cert right?
Muddasar Ahmed (MITRE): So it can be used for identity and authorization. But
Muddasar Ahmed (MITRE): if you don't have a complete security system.
Muddasar Ahmed (MITRE): all it does is between 2 communicating party
Muddasar Ahmed (MITRE): help choose, establish mtls using x 5 0, 9
Muddasar Ahmed (MITRE): or
Muddasar Ahmed (MITRE): java web token.
Muddasar Ahmed (MITRE): Jason web token. But
Muddasar Ahmed (MITRE): nothing is said beyond. So then I did some research. I realized that there was
Muddasar Ahmed (MITRE): proposal out there in Ietf
Muddasar Ahmed (MITRE): how to integrate
Muddasar Ahmed (MITRE): with the complete security system like your oath. And
Muddasar Ahmed (MITRE): you know, when you have a system of system, how would it work.
Muddasar Ahmed (MITRE): I just wanted to bring it out to this, because I think
Muddasar Ahmed (MITRE): Bian, you've been talking to nephew community and other places. Let me go to or analyze. I think it. It might be a good idea to kind of take a look at it. Very short. Read. It's not long ietf drafts like maybe 6 or 7 pages.
Pawel Pawlak: Yeah.
Muddasar Ahmed (MITRE): Especially important is those use cases.
Muddasar Ahmed (MITRE): And then, you know the folks who are supporting it. They've been in the industry, and I think their use cases are really
Muddasar Ahmed (MITRE): well laid out.
Muddasar Ahmed (MITRE): I like the way they wrote the used cases as a security engineer. I wanna be able to do this.
Muddasar Ahmed (MITRE): though.
Muddasar Ahmed (MITRE): it's very interesting. Read, I think it might bring you some insights into thinking, especially with the
Muddasar Ahmed (MITRE): Oran or 5G type of workloads.
Muddasar Ahmed (MITRE): You really need to integrate stuff done salt and pepper.
Muddasar Ahmed (MITRE): And they don't work well.
Muddasar Ahmed (MITRE): Him
Muddasar Ahmed (MITRE): that.
Maggie Cogdell: This is good. Thank you.
Byung-Woo Jun (Ericsson Software Technology): It's good.
Amy Zwarico (AT&T Services, Inc.): Could you include this link in? Is the link in the minutes?
Amy Zwarico (AT&T Services, Inc.): Fiercely copying.
Pawel Pawlak: I will, I will add them. Yeah, I think the best would be to add under the.
Pawel Pawlak: as you said this are for the hmm.
Pawel Pawlak: nephew, part right.
Muddasar Ahmed (MITRE): Yeah, that's where it was discussed previously started. The nephew one
Muddasar Ahmed (MITRE): with the Sig
Muddasar Ahmed (MITRE): here.
Byung-Woo Jun (Ericsson Software Technology): And.
Pawel Pawlak: We.
Byung-Woo Jun (Ericsson Software Technology): So we're connecting that to Oran Alliance, Emmy walks 11. Are you working with 11.
Amy Zwarico (AT&T Services, Inc.): Group. I'm Work Group 11.
Byung-Woo Jun (Ericsson Software Technology): So anyway, we yes.
Amy Zwarico (AT&T Services, Inc.): Was that the link?
Amy Zwarico (AT&T Services, Inc.): Yeah, there it is. The Gilman.
Muddasar Ahmed (MITRE): Yeah.
Byung-Woo Jun (Ericsson Software Technology): 2, 2, link yes.
Amy Zwarico (AT&T Services, Inc.): Yeah.
Byung-Woo Jun (Ericsson Software Technology): Yeah, it's good topic to bring into nephew nephew, for now focus on workload identity
Byung-Woo Jun (Ericsson Software Technology): and then move on to service mesh. And then, later on, connecting that to us to Ydc.
Byung-Woo Jun (Ericsson Software Technology): but for now, workload identity. So
Byung-Woo Jun (Ericsson Software Technology): yeah, I take a look at this use case.
Muddasar Ahmed (MITRE): If if you
Muddasar Ahmed (MITRE): sort of
Muddasar Ahmed (MITRE): decompose right?
Muddasar Ahmed (MITRE): Between, I you know identity. Icm item studies
Muddasar Ahmed (MITRE): and the 0 trust.
Muddasar Ahmed (MITRE): you divide between
Muddasar Ahmed (MITRE): the human or users.
Muddasar Ahmed (MITRE): Devices, processes, right? Lot of these things always have some sort of privilege attached to them.
Byung-Woo Jun (Ericsson Software Technology): Right.
Muddasar Ahmed (MITRE): So when we're thinking, either
Muddasar Ahmed (MITRE): you know, service mesh.
Muddasar Ahmed (MITRE): or just general workload identity or any kind of other stuff.
Muddasar Ahmed (MITRE): then we should decompose things 1st say alright. This is what we do right right now
Muddasar Ahmed (MITRE): on Linux. Have a local accounts, or
Muddasar Ahmed (MITRE): we use a lot.
Muddasar Ahmed (MITRE): Those things won't go away right? So the processes or Apis users and devices.
Muddasar Ahmed (MITRE): they can assume identity, and with identity they can assume certain privileges
Muddasar Ahmed (MITRE): and then try to bring them together, said all of these were should work together at the same policy.
Maggie Cogdell: -
Muddasar Ahmed (MITRE): Creation point
Muddasar Ahmed (MITRE): and policy enforcement one like in service. Mesh, we do policy enforcement. You can create policy somewhere else, right?
Muddasar Ahmed (MITRE): But if we decompose how we do today with these kind of things in mind, and then bring a new capability
Muddasar Ahmed (MITRE): and then trying to integrate again.
Muddasar Ahmed (MITRE): We'll figure out, you know if it works well or doesn't work well.
Muddasar Ahmed (MITRE): The idea is that if you do policies at 10 different places like we do in.
Maggie Cogdell: Oh, gosh!
Muddasar Ahmed (MITRE): You know the the router guy does his own acls.
Muddasar Ahmed (MITRE): The system admin does his own security controls and
Muddasar Ahmed (MITRE): you know, or integration.
Muddasar Ahmed (MITRE): we always have these
Muddasar Ahmed (MITRE): gaps. They are left
Muddasar Ahmed (MITRE): accidentally or unknowingly.
Muddasar Ahmed (MITRE): That cause problems.
Muddasar Ahmed (MITRE): So we could, if we could, do this exercise with decomposing first, st then creating
Muddasar Ahmed (MITRE): the the capability it provides.
Muddasar Ahmed (MITRE): and doing a little bit of what? F analysis, if that capability fails like your Acl around the network parameter fails, then what
Muddasar Ahmed (MITRE): right?
Muddasar Ahmed (MITRE): Or if they.
Muddasar Ahmed (MITRE): the access control list on your host fails. Then what
Muddasar Ahmed (MITRE): I think
Muddasar Ahmed (MITRE): those 2, 3 what if analysis will bring in a good insight whether the architecture architecture we're putting together.
Muddasar Ahmed (MITRE): It's gonna be ho holding to.
Muddasar Ahmed (MITRE): And plus one failures. Usually a lot of the the bridges and stuff is just one control failure and it adversary has to do multiple controls failures
Muddasar Ahmed (MITRE): before they can achieve their objectives.
Maggie Cogdell: Good. Yeah.
Amy Zwarico (AT&T Services, Inc.): So you know, there's a lot of work going on with the idea of policy and
Amy Zwarico (AT&T Services, Inc.): and under 0 under the various 0 trust architecture initiatives. I'm on one with Addis, where we're looking at 5G. 0, trust. There is actually some. There's a work item under work Group 11 in Iran Alliance. That's doing 0 trust architecture and a a essentially the
Amy Zwarico (AT&T Services, Inc.): the
Amy Zwarico (AT&T Services, Inc.): mapping of what we've got so far in terms of requirements to 0 trust architecture.
Amy Zwarico (AT&T Services, Inc.): So there's a lot of work going on there. And and I think it's very related to policy.
Amy Zwarico (AT&T Services, Inc.): because that is one of the tenets of of 0 trust. You know you've you've got to have
Amy Zwarico (AT&T Services, Inc.): dynamic policy, meaning that it it. You know your policy isn't static that somebody just wrote it once, you know, and often that's that translates into oh, well, as long as you're authenticated you can do whatever
Amy Zwarico (AT&T Services, Inc.): So I think that there's there is actually a lot of interesting policy work going on, but there's a ton of it.
Amy Zwarico (AT&T Services, Inc.): It's hard to keep up with. But at the end of the day. And and I keep kind of going back to this, that it's that the the idea of dynamic policy and being able to push policy effectively and efficiently.
Amy Zwarico (AT&T Services, Inc.): there have been good implementations of it for
Amy Zwarico (AT&T Services, Inc.): 25 years at least. Minimally.
Amy Zwarico (AT&T Services, Inc.): Certainly some of the early web single sign on.
Amy Zwarico (AT&T Services, Inc.): And I'm thinking specifically, the siteminder product
Amy Zwarico (AT&T Services, Inc.): had
Amy Zwarico (AT&T Services, Inc.): they had really nice pol. They had a a very nice policy framework within the product.
Amy Zwarico (AT&T Services, Inc.): where
Amy Zwarico (AT&T Services, Inc.): not only could you define the policy centrally, but it would. The policies would get updated
Amy Zwarico (AT&T Services, Inc.): so that they could be cached, and so that essentially at each agent could be caching the policies, and they had a good, a good methodology for pushing updates. And that you know, basically pushing the diffs. It was all the engineering work behind it, but it worked very, very well.
Amy Zwarico (AT&T Services, Inc.): and
Amy Zwarico (AT&T Services, Inc.): so there's been a ton of work. In short thing, there's been a ton of work there for
Amy Zwarico (AT&T Services, Inc.): 25 years, and I think it's interesting that it's really been identified in in the 0 trust field. I hope they don't spend a lot of time reinventing a wheel. But
Amy Zwarico (AT&T Services, Inc.): you know, you never know what's gonna happen. Do you.
Muddasar Ahmed (MITRE): Yeah, I think the the
Muddasar Ahmed (MITRE): what? What has it been happening? Right? At least since I joined it. Work in 97, 98
Muddasar Ahmed (MITRE): was that
Muddasar Ahmed (MITRE): there is a translation failures, and there is a
Muddasar Ahmed (MITRE): sort of
Muddasar Ahmed (MITRE): ignoring the fact. Who owns and who's responsible for the data.
Amy Zwarico (AT&T Services, Inc.): Umhm? What.
Muddasar Ahmed (MITRE): I call the product owner data on, or a system owners
Muddasar Ahmed (MITRE): versus
Muddasar Ahmed (MITRE): the the Id staff.
Muddasar Ahmed (MITRE): So there's been this summarization like, I remember, my 1st job
Muddasar Ahmed (MITRE): was on Item Icam for Fdic
Muddasar Ahmed (MITRE): creating accounts. And we're assigning privileges.
Muddasar Ahmed (MITRE): So any stuff that goes to the legal, financial or other groups
Muddasar Ahmed (MITRE): we just created this big
Muddasar Ahmed (MITRE): object groups in the empty Directory.
Muddasar Ahmed (MITRE): And if we got the email, he said, I would need access to the contracts or legal and stuff.
Muddasar Ahmed (MITRE): it was just completely assigned to them. So anybody who's assigned to one case can go look at every single banking case in Fdic.
Amy Zwarico (AT&T Services, Inc.): I know which is, you're like sitting there going. What.
Muddasar Ahmed (MITRE): Yeah, so it.
Amy Zwarico (AT&T Services, Inc.): You know, the 1st time you do a sox audit on that very bad things happen.
Muddasar Ahmed (MITRE): Yeah.
Byung-Woo Jun (Ericsson Software Technology): Okay.
Muddasar Ahmed (MITRE): So I think it's time now that we have tooling
Muddasar Ahmed (MITRE): where we could say.
Muddasar Ahmed (MITRE): How does the person who is responsible for the data or system?
Muddasar Ahmed (MITRE): Who does he want to give access to?
Muddasar Ahmed (MITRE): And how do you create granular access?
Muddasar Ahmed (MITRE): And then you decide which control you're going to use to provide whether or not people are allowed to get on the network.
Muddasar Ahmed (MITRE): let alone, you know, accessing the server or the database table that's hosted, or even the record row that's in the table.
Muddasar Ahmed (MITRE): Now we have that capability.
Muddasar Ahmed (MITRE): We haven't been using because the protocol has been. If it's an engineering server and you are an engineer, you have access to it.
Amy Zwarico (AT&T Services, Inc.): Well, and I think I think that
Amy Zwarico (AT&T Services, Inc.): you know that's a you bring up interesting points, because certainly, and and working for a very large company,
Amy Zwarico (AT&T Services, Inc.): and managing people. I I spent a certain amount of time
Amy Zwarico (AT&T Services, Inc.): having to
Amy Zwarico (AT&T Services, Inc.): a
Amy Zwarico (AT&T Services, Inc.): confirm that the people who work for me still need access to the systems that they claim they need access to as an app owner spend time saying, Yeah, this looks like, yes, these people should. You know there's a good reason why they're still in there.
Amy Zwarico (AT&T Services, Inc.): There is a lot of that going on, is it a hundred? Is it?
Amy Zwarico (AT&T Services, Inc.): Is it as good as it could be? No.
Amy Zwarico (AT&T Services, Inc.): but you know, and I think that
Amy Zwarico (AT&T Services, Inc.): that really goes to the heart of this dynamic policy is that I can is that you don't just create a user.
Amy Zwarico (AT&T Services, Inc.): And any arbitrary person can create a user. You you need to have.
Amy Zwarico (AT&T Services, Inc.): And you know, you you need to have that identity management piece of it.
Amy Zwarico (AT&T Services, Inc.): because kind of, and the enforcement is easy.
Amy Zwarico (AT&T Services, Inc.): Answering a binary question is access allowed
Amy Zwarico (AT&T Services, Inc.): is, the is much easier. So the policy enforcement point is way easier
Amy Zwarico (AT&T Services, Inc.): than
Amy Zwarico (AT&T Services, Inc.): the policy then maintain, then cleanly and effectively maintaining a policy information point. That's hard.
Maggie Cogdell: Yeah.
Amy Zwarico (AT&T Services, Inc.): And I think that any large organization will tell you how hard that is.
Muddasar Ahmed (MITRE): And I think it's it's some of the complexity of new systems that we see now. Like when you look at the
Muddasar Ahmed (MITRE): Or and life cycle.
Muddasar Ahmed (MITRE): You may make a call to O Cloud to create resources.
Muddasar Ahmed (MITRE): and you may get a cu image instantiated by O Cloud.
Muddasar Ahmed (MITRE): and then comes your small who wants to put some configuration? Then comes your
Muddasar Ahmed (MITRE): course slice concept.
Muddasar Ahmed (MITRE): So there's a 3 different times in the life cycle. 3 different systems are going to create an identity
Muddasar Ahmed (MITRE): for a workload.
Muddasar Ahmed (MITRE): Alan, you have to update security policy accordingly. That's why I think Orn is pretty good example where multiple system will come together. Your queue, that is, gonna create a generic instance of workload.
Muddasar Ahmed (MITRE): Then your
Muddasar Ahmed (MITRE): the snow is going to turn that generic to a particular Cu serving a particular cell. Id.
Muddasar Ahmed (MITRE): And then comes the slice from the core, and or and combined, saying, Oh, this is a, you know, embb slice, for let's say Mitric Corporation or at T corporation.
Muddasar Ahmed (MITRE): Therefore the workloads need to have
Muddasar Ahmed (MITRE): isolation properties as such.
Muddasar Ahmed (MITRE): So your policies
Muddasar Ahmed (MITRE): is being considered in a very gradual manner.
Muddasar Ahmed (MITRE): and your controls will be changing when it was generic.
Muddasar Ahmed (MITRE): If I only have parameter security when it becomes cu.
Muddasar Ahmed (MITRE): It had Oran parameter security.
Muddasar Ahmed (MITRE): and when it becomes sliced.
Muddasar Ahmed (MITRE): then, maybe even down to the physical level.
Muddasar Ahmed (MITRE): The workload was isolated from the rest of the orm components.
Muddasar Ahmed (MITRE): So to me, that brings a good complexity for somebody.
Muddasar Ahmed (MITRE): Developing a policy, a workflow and enforcement points
Muddasar Ahmed (MITRE): that can satisfy in 3 stages of its life.
Muddasar Ahmed (MITRE): So something to consider buying when you're working with the nephew. Is that
Muddasar Ahmed (MITRE): the dynamicity of
Muddasar Ahmed (MITRE): there's 3 stages.
Muddasar Ahmed (MITRE): you know, genetic component.
Muddasar Ahmed (MITRE): a specific component like network function.
Muddasar Ahmed (MITRE): and then
Muddasar Ahmed (MITRE): custom slice, sla requiring it
Muddasar Ahmed (MITRE): to be isolated at certain level.
Muddasar Ahmed (MITRE): Okay.
Byung-Woo Jun (Ericsson Software Technology): Thank you.
Muddasar Ahmed (MITRE): That's it. We'll look into it at. This is like a another one of my side gig project to
Muddasar Ahmed (MITRE): kind of bring together. What does Zta wants? What are the tools out there? And
Muddasar Ahmed (MITRE): how can we just
Muddasar Ahmed (MITRE): make these things work
Muddasar Ahmed (MITRE): where they should?
Muddasar Ahmed (MITRE): While considering, you know, what are these n plus failures, we trying to accommodate right? In most cases it should be at least 2 control. One fails other works.
Muddasar Ahmed (MITRE): We shouldn't be putting controls out there that it fails, that we don't have
Muddasar Ahmed (MITRE): anything to defend ourselves again.
Byung-Woo Jun (Ericsson Software Technology): Okay.
Pawel Pawlak: And he
Pawel Pawlak: thank you for sharing
Pawel Pawlak: very interesting topic
Pawel Pawlak: handling end to end. Kind of.
Pawel Pawlak: I send the questions in the
Pawel Pawlak: comments.
Muddasar Ahmed (MITRE): No. So that's it. Maybe starting next week, if Tony shows up and we'll start working on
Muddasar Ahmed (MITRE): putting together a list of kpis.
Pawel Pawlak: yeah, why not?
Amy Zwarico (AT&T Services, Inc.): Sounds good.
Pawel Pawlak: Okay.
Pawel Pawlak: thank you very much. Guys, thank you for today. And yeah, let's talk together
Pawel Pawlak: next Tuesday, same time.
Pawel Pawlak: Have a wonderful rest of today. Take care.
Pawel Pawlak: Thank you.
Muddasar Ahmed (MITRE): Aye.
Pawel Pawlak: You may.