Page History

Presentation provided by Brianna and Bert. Great job (150 hours → 2 hours)! Safes a lot of manual work for us.

Enhancements for the future:

• flag for failing CLM scanning jenkins job (older than 1 week)
• CVE list with threat levels ratio
• remove _xD000_ for CVE's names
• log4j-core recommended version to be updated into 2.17.1 
• usage of Wiki reference with recommended versions as single source of true as dynamic
• configure other jobs option - non master that would be usefull for Maintenance Release analysis
• additional tab with unstructured data

import excel into confluence:

https://community.atlassian.com/t5/Confluence-articles/How-to-import-an-excel-file-into-Confluence-using-Elements/ba-p/1672151

Event June 13th-16th Porto, Portugal

Please register: https://events.linuxfoundation.org/lfn-developer-testing-forum/

• SECCOM topics proposal:

  • SECCOM retrospectives:
    • Log4j fix implementation in Istanbul Maintenance Release
    • Jakarta security status update
  • Kohnsecuritygoals:
    • Global Requirements and Best Practices
    • Security PoCs:
    • logging req
    • code quality
    • service mesh
  • SBOM enablement and maintenance, and packaging
  • Waiver policy update
  • Unmaintained projects joint meeting with Amy, Thomas and Andreas, Chaker and Byung.
  • On the road to gold badge - Tony and Toine - potential issue with remote participation for Tony.
  • Operator perspective on ONAP security – Amy, Andreas? Brian? Fabian?
  • Security principles in the implementation – Tony, Maggie - work in progress, risk to deliver for one of next conference.

Remaining topic proposals to be submitted.

Brian to share what kind of security due diligence is performed by BellCanada. ONAP is used for 5G slicing orchestration.

Fabian to check if could contribute on how qualify software to be deployed, what duediligence was performed. 

Follow-up with Kenny to be done.

• ONAP unmaintained and deprecated functions – Amy – presentation of updated version at PTL yesterday
• RACI matrix by Muddasar – waitig for a feedback from PTLs and Chaker
• Update on failing security tests below:
• Synch with OOM:
  • Security dashboard: https://logs.onap.org/onap-integration/daily/onap-daily-dt-oom-master/2022-04/18_06-28/ and
  • Versions reporting: https://logs.onap.org/onap-integration/weekly/onap_weekly_pod4_master/2022-04/18_00-27/ latest run by Michal for the weekend
  • Failing security tests:
  • fix nonssl_endpoints in Jakarta release:

1.SDC-3954 - open

2.SDNC-1692 - done

3.OOM-2957 – open – reassigned to Fiachra

• • fix root_pods in Jakarta release:

1.OOM-2958 – open - reassigned to Fiachra

2.INT-2104 – in progress

Tony presented 5Y project review – CPS volunteered to be PoC and review questionaire.

Amy presented to ArchCom and to present

to

TSC

12 May. Good exchanges with Chaker, Byung:

• we should make dependency on OOM before removing Jenkins jobs (including projects without PTLs).
• change to repo to be verified, if no change it means repo was not touched and to be validated by Architecture Subcommittee

Updated presentation is available below.

Amy to present

at 12 May TSC call

.

Outline for the yellow to be added.

Update on failing security tests below:

• • Security dashboard: https://logs.onap.org/onap-integration/daily/onap-daily-dt-oom-master/2022-04/18_06-28/ and
  • Versions reporting: https://logs.onap.org/onap-integration/weekly/onap_weekly_pod4_master/2022-05/08_13-23/ latest run by Michal - only 29% for security tests covera
  • Failing security tests:
  • fix nonssl_endpoints in Jakarta release:

1.SDC-3954 - open

2.SDNC-1692 - done

3.OOM-2957 – open – reassigned to Fiachra

• • fix root_pods in Jakarta release:

1.OOM-2958 – open - reassigned to Fiachra

2.INT-2104 – in progress

• https://gerrit.onap.org/r/c/ci-management/+/128405

-Jess is trying to validate the procedure

• SBOM still not working in sandbox

Adoption issue requires manual manipulation of workspace flag.

Next step to get PTL onboard and set target date when LF IT would implement ONAP projects

• IT-23828 2FA (2 Factor Authentication) needed for merging to Gerrit in ONAP – info from Andrew G. „It's possible but non-trivial at present. I'm working on trying to make a case for making this easier to do as I can get 2FA turned on, but then if people need to change things related to it it would require helpdesk intervention with no self-service. Basically, our current setup is user hostile and could be made significantly better.”
• IT-23829 Hardening LFN hosted ONAP project web sites – goodprogress
• Gerrit has now been updated to receive and A grade on securityheaders.com (thanks to this change we will be getting this on all of the Gerrit we operate as the systems pick up their updates).
– done – info from Andrew G. All 3 Nexus systems for ONAP are now reporting grade A. We'll be taking these changes to our other managed Nexus systems as well, so thanks for the poke to improve our security posturę. We are still working on getting the headers fixed for the nexus systems (getting a C) as well as the strengthening the wiki and jira systems (scores. They're already getting an A but both of them are showing some items that could be made stronger).

https://lfnetworking.org/wp-content/uploads/sites/7/2022/04/LFN-Security-Whitepaper-v4.pdf?utm_campaign=LFN%20Newsletter&utm_medium=email&_hsmi=210819121&_hsenc=p2ANqtz-8l0-nc3Y9V0NGaQ63h3EBkuxAT5KxkeHGJJ_bM7pbtql_aQEOQvjeTpEsJrDmEQCzJ2c2Ar7yeIU45g9PD0JX30oKCkQ&utm_content=210819121&utm_source=hs_email

• ”

Ajay (Ericsson) is working on the connection between FluntBit and ElasticSearch. He is leaving Ericsson end of this week, so some of our OOM team members have key learning sessions with him. I told Ajay to check in his code. We plan to report our log PoC progress/demo to SECCOM sometime soon. That is the plan.

Prototype for logging fields.

Discussed whether MFA should be natively supported by ONAP.

• Users of ONAP will likely want to integrate with their own identity and access management (IAM) platforms
• ONAP could provide out of the box integration with an open source IAM platform such as KeyCloak

OOM is working on ServiceMesh even though there is no OOM PTL

EST (E///) and DT have a goal is to complete the ServiceMesh in Kohn

• EST working on integration/implementation
• DT is doing Testing

Invite ServiceMesh SMEs to SECCOM meeting for update.

Pawel to invite ServiceMesh SMEs to SECCOM call.

Need to identify the EST and DT SMEs

tp be presented on May 9th to PTLs.

• request volunteers
• original ONAP projects are highest priority
• newer projects also eligible for reviews

Link to recording and slide deck: 

https://wiki.lfnetworking.org/display/LN/LFN+Security+Forum

review for the near future – are our pipeline or processes optimal?

We shall have Jira issues for all technical dept issues to track it.

To review last 2 slides ta the next meeting - slides to be shared by Muddasar to SECCOM distribution list - done.

One slide to be prepared and then shared with PTLs and architecture subcommitee

.

SECCOM MEETING CALL WILL BE HELD ON 17th OF MAY'22. 

Review of technical debt slides with special focus on 2 last ones.