...
Jira No | Summary | Description | Status | Solution | ||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
M4 update | Java and Python - waivers issued after PTL's meeting. Merges issued by SECCOM. Strong improvement from Honolulu release. To create best practice for standard integration images, so we could get rid of old Python and Java. Security scans 100% → 57% - to be further investigated.
The gaps on the restricted Wiki shall be covered by respective PTLs. | ongoing | ongoing | |||||||||||||||||
Software BOMs |
| Software BOMs | Nexus-IQ server was upgraded to the latest version - now has some capability to extract Software BOMs but some information is still missing. | ongoing | Muddasar to research on how the missing information can be collected (plugin to be used?). | Logging requirements | Final set of metadata fields, which ones would be provided by logging service and which by developers. PTLs invited for Friday’s meetings. Welcome Sean who is helping in prototyping for SW BOMs. | ongoing | Dependency confusion attacks vs. ONAP SW build process | We put this item into backlog - we have no resources to lead it. | on hold | |||||||||
Last TSC |
| ongoing | To further investigate Jira or feature template capability for that to include compliance requirement for Globar Requirement or Best Practice and then turnet into mnual or automatic validation. | |||||||||||||||||
ONAP documentation | From green user perpective - a lot of info is missing on how to install ONAP or upgrade it - lot of missing information from ONAP documentation. Troubleshooting based on logs is painfull... Solution level thinking from user perpective, how to start and what is the sequence to install ONAP. Sean is exploring POM file and some documented ONAP interdependencies. In Amy'steam some developer is also doing similar effort. | ongoing | Pawel to sent an information to documentation team. We need a dependency map. Angular experience to be shared if possible. | |||||||||||||||||
Feature intake template | Muddasar did not find prove of tracking the feature after its approval. | ongoing | To reach out PTLs on what could be the best way to tackle Jira template. Muddasar will propose some initial template, contributions are welcome. Muddasar will also reach out Alla as a follow up, feedback from testers might be also valuable. | |||||||||||||||||
New Best Practice for Jakarta | Security Risk Assessment and Acceptance | Guide for threat modeling for developers: https://martinfowler.com/articles/agile-threat-modelling.html We would like to get some help from the guys who are doing the actual development. Excel file shared with Brian, Amy shared also framework info on two references for threat modeling. 1.ISO 27005 : https://www.iso.org/standard/75281.html 2.NIST Special Publication 800-154 2 Guide to Data-Centric System Threat Modeling https://csrc.nist.gov/CSRC/media/Publications/sp/800-154/draft/documents/sp800_154_draft.pdf | ongoing | Do we have a data map to show elements moving through the system? | Last PTLs meeting | Good progress on fulfilling global requirements from SECCOM. Fabian presented the status of code quality
| ongoing | Pawel to create the page. ONAP code quality improvement Fabian to create a Jira ticket to LFN IT: https://jira.linuxfoundation.org/plugins/servlet/theme/portals | Feature intake template | Muddasar was introduced to Alla who is leading ONAP Requirements Subcommittee to be contacted to provide details. We need to have a standard template for the feature to be accepted (visibility, security and usability sections should be there). | ongoing | To create a Jira ticket template. To be checked if the feature specific information is further tracked. | Last TSC meeting |
| ongoing | Jakarta SECCOM requirements | Apart from current global requirements we might want to follow any other requirements:
| started | New requirement to be created for security logging but PoC with CPS or best practice for Jakarta.This item to be discussed with Byung on | |
Logging requirements | Base images provision by Integration team to PTLs as a good foundation for logging and logger helper. | ongoing | Present idea to PTLs and socialize from Architecture perspective (Friday's meeting. | How info.yaml is generated? | ongoing | This item to be discussed with PTLs on Friday?). Meeting invitation to be shared by Amy to Toine and Vijay. After initial discussion idea could be presented during the PTL's meeting. | ||||||||||||||
Chartmuseum | Slides presented by Tony uploaded below. Requirement to support by DCAE registry for HELM charts. Chartmuseum is maintained by Chart team. 3 types of authentication supported. Proposal is to restrict the client's list, once they have user names and passwords only ones who have to update/delete charts limits writing and access considerable just for those particular clients. FW to be used to limit the access for reading to strictly ONAP applications. mTLS could be a solution for read? Side car with cert could be interesting. | ongoing | mTLS to be considered | CADI and AAF replacement | DCAE and DMaaP communication - new proposal to be presented today at the Architecture Subcommittee. | ongoing | Byung to present update for the next SECCOM | |||||||||||||
OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 28th OF SEPTEMBER'21. |
Recording:
View file | ||||
---|---|---|---|---|
|
SECCOM presentation:
View file | ||||
---|---|---|---|---|
|
View file | ||||
---|---|---|---|---|
|