Page History

New ticket was opened as old one was closed by Jess. Reference link provided by Jess points out to the deprecated API documentation. Tony provided his comment under the ticket. It seems that the new reference is for API documentation that will stop working in a few months. So it is a workaround and not ultimate solution.

The replacement we should be using accroding SonarCloud requires explicit permissions to search varoius different repos to be granted to the person doing search which is not a good solution. 

https://lists.onap.org/g/onap-requirements-sub/viewevent?eventid=1437425&calstart=2022-02-28

Presentation available at the bottom of this page. Security Logging Requirements were presented to Use Case Subcommittee.

Toine agreed to be a project for a PoC.

Issue seems to be finally resolved.

homas asked to propose a patch for the composite release notes that includes info from slide 6.

https://wiki.lfnetworking.org/display/LN/2022+LFN+Security+whitepaper

Contribution needed for SBOM part – Sean/Bob done

-NTIA paper could be a good reference.

Tony and Amy will try to use AT&T leverage as SonarCloud customer to get info on API documentation.

• Tony (slides 8 and 9):
• Maggie:

(1) OWASP Top 10

• • https://owasp.org/Top10/

(2) BSIMM

• • https://www.bsimm.com/framework.html

(3) Secure Software Development Framework 

• • https://csrc.nist.gov/Projects/ssdf

  This publication is a little different and is actually geared more for when selecting products and making good choices on deployment across the   enterprise.  However, it does bring up points that we may want to consider addressing across the architecture.

(4) CIS Critical Security Controls

• • https://www.cisecurity.org/controls

• Muddasar:

-Security Belts structures activities of the secure software development

-https://github.com/AppSecure-nrw/security-belts

-OWASP Devsecops Maturity Model       

-https://dsomm.timo-pagel.de

-DevSecOps Platform-Independent Model: Requirements and Capabilities-SEI (FFRDC) Technical report (figure 7)

-https://apps.dtic.mil/sti/pdfs/AD1152747.pdf

-ISACA Cybersecurity Maturity Assessment (self-assessment)

-https://www.isaca.org/enterprise/cmmi-cybermaturity-platform#cmmicp-tabs

ONAP 5Y assessment should be a group capability assessment where we stand for the security measures that we have and how we measure it.

From assessment on per each project level we will get an image of ONAP as a whole.

Pawel to create criteria's proposal (kind of high level document propsoal) for futher review based on Figure 7.

Log4j SECCOM recommendation for Istanbul Maintenance release presented

https://wiki.onap.org/display/DW/Jakarta+Best+Practice+Proposal+for+Standardized+Logging+Fields

Some more clarifications planned, naming causing some confusion.

One more session (on 25th of February) to complete fields review.

Next to be reviewed with PTLs.

Jess had trouble with polling dependencies from some project. All CLM jenins jobs are failing now.

We want to make SBOM available to end user.

We are compliant to MVP for fields for SBOM.

SPDX 3.0 standard will have an extended field capability (long list of optional atributes) and there will be a new ISO standard associated.

Amy made some contributions already. Contribution needed for SBOM part – Sean to be addressed.

https://wiki.lfnetworking.org/display/LN/2022+LFN+Security+whitepaper

Tony working with David and Dave on getting projects moved from having owner from project and replacing with David for Badging. Some owners gone away... Additional editors do not have rights to remove somebody from the project (can only add additional people).

No movement. Waiting for an answer from David Wheeler.

To join SO meeting.

To drop an e-mail to Toine.

SECCOM MEETING CALL WILL BE HELD ON 8th OF MARCH'22. 

Quality gates for code quality improvements - continuation of the discussion.

5Y review criteria.