Location: Warsaw, Poland
- 28th of November - Samsung “Warsaw Spire” building
plac Plac Europejski 1
Links to Warsaw Spire information: https://en.wikipedia.org/wiki/Warsaw_Spire, http://www.warsawspire.pl/en/#/key-data
9AM - 5PM
Building access is controlled at Warsaw Spire, please stop at Samsung Desk on the first floor to pick up your badge.
Room: Samsung VIP Conference Room, 23rd floor.
- 29th of November - Orange Lab Labs in Warsaw
- Warsaw Orange Labs building at Obrzezna 7: https://www.google.pl/maps/place/Orange+Labs/@52.1763727,20.9986067,17z/data=!3m1!4b1!4m5!3m4!1s0x471932df64cf07df:0x313c7f8c17ada26d!8m2!3d52.1763694!4d21.0008007
- 9AM - 12Noon
Zoom Bridge: https://zoom.us/s/641966405
One tap mobile +16465588656,,641966405# US (New York) +16699006833,,641966405# US (San Jose)
Dial by your location: +1 877 369 0926 US Toll-free +1 855 880 1246 US Toll-free
Meeting ID: 641 966 405
Find your local number: https://zoom.us/u/afKvl26PD
Recommended Hotels
Westin (5 star rating)
Golden Tulip Warsaw Centre (4 star rating)
Hilton (5 star rating)
Intercontinental (5 star rating)
For people with limited budget: Hotel Campanile Warszawa (3 star rating)
Proposed Agenda
...
| Time | TopicTop | Driver/Presenter | Description | |||
|---|---|---|---|---|---|---|
| 28 November | ||||||
| 9:00 - 9:1515min | Status of the Casablanca Priorities (SECCOM-82) | Amy | Review the Casablanca security achievements 18_11_28_ONAPCasablancaSecurityPrioritiesStatus.pptx | |||
| 9:15 - 10:0030min | Outline Dublin Security Priorities (SECCOM-73) | Stephen | Create the Dublin security priorities draft to review with seccom and present to the TSC | |||
| 10:00 - 10:30 | Vulnerability Management Process Review (SECCOM-63) | Pawel/Robert | Updates to the vulnerability management process | |||
| 10:30 -10:45 | Break | |||||
| 10:45 11:1530min | Silver CII Badging (SECCOM-79) | Amy | Determine the Silver requirements the projects need to focus on for Dublin and the requirements that are met by the overall ONAP processes 18_11_28_ONAPDublinCIISilverRequirements.pptx | |||
| 11:15 - 12:00 | Relationship between vulnerability reviews and release gates (relates to security by design (SECCOM-75)) | Amy | 30min | Relation between vulnerability and release gates | Lessons learned from the Beijing and Casablanca reviews | Enumerate the vulnerability mitigates tasks for each milestone and release candidate. This will help the projects schedule package upgrades, replacements, and the development of compensating controls early in the release cycle. |
| 1hr | Vulnerability Management Process Review | Lessons learned from the Beijing and Casablanca reviews Modify the review table to clarify the information the projects must provide Suggestion of how to improve the review process | ||||
| 12:00 - 1:00 | Lunch | |||||
| 1:00 - 1:45 | Vulnerability handling clarifications (SECCOM-88) | Amy | Create a simple workflow that will be used to explain the vulnerability remediation and documentation process to the PTLs 18_11_28_ONAPDublinVulnerabilityReviewsAndMilestones.pptx (see page 5) | |||
| 1:45 - 2:30 | API Security (SECCOM-80) | Natacha | Review the ETSI API security recommendations and requirementsONAPseccom-API_security.pptx | |||
| 2:30 - 2:45 | break | |||||
| 2:45 - 3:00 | Risk Assessment Review (SECCOM-81) | Pawel/Samuli | 1hr | Risk Assessment Review | Review the findings from the risk assessments Discuss the questionnaire proposed by Robert to help identify risk in | |
| 1hr | API Security | Review the ETSI API security recommendations and requirements | ||||
projects ONAP Beijing Security Assessment (DB & Kubernetes) 27-11-2018--ONAP-Beijing-Security-Assessment.pptx ONAP Beijing CIS Benchmark for K8S test: CIS_Kubernetes_1.1.xlsx Risk Assessment table (still under development and not yet mature): ONAP Risk Assessment table v 0 8.xlsx | ||||||
| 3:00 - 4:00 | Risk Assessment Overall Plan. Also in (SECCOM-81) | Pawel/Samuli | Define the scope of the risk assessment and the plan to complete the assessment Focus on some selected areas of risk | |||
| 4:00-4:15 | Break | |||||
| 4:15 -5:00 | wrap up | |||||
| 29 November | ||||||
| 9:00 - 10:00 1hr | ONAP Communication Security Requirements | Pawel | Review communication security between ONAP components and | 1hr | MSB Security Requirements | Review MSB communication security and ensure that the transactions exchange between the different components are secure (Authentication, Authorization, Confidentiality) |
| 10:00 - 10:30 | Security by design (SECCOM-75) | Stephen | What guidelines are required to projects and the milestones to place security first and foremost.
| |||
| 10:30-10:45 | Break | |||||
| 10:45-11:15 | Security Guidelines (SECCOM-93) | Zygmunt | Develop | 1hr | Security Guidelines | Develop a plan to document the security of ONAP |
| 1hr | Review of Action Items | |||||
| 11:15-12:30 | Discussion and Review Action Items | Amy | Review the meeting; assign action items | |||
| 12:30-1:30 | Lunch | |||||
| 1:30-4:00 | Backup if needed | Additional discussions among participants still available | Discussion |
Proposed Topics
- Relation between vulnerability and release passing the gates
- To clarify the importance of vulnerability management and its impact on passing the project release management gates. To study the relevance to link the release management and the vulnerability management processes.
- Vulnerability Management process review
- The goal is to ensure that the process is completed (lack of TBD items, added workflow and other comments coming from Robert) and well known by security subcommittee members and other ONAP members (at least PTLs). A follow-up per project could be considered in order to encourage them to make progress, or at least a Dashboard in order to have a clear overview. Lessons learned.
- Risk Assessment review
- Review by community the table developed during series of risk assessment meetings and discussion on questionnaire proposed by Robert to identify risks from projects with closed questions types.
- API security
- To review existing recommendations and focus on missing part. ETSI has published recommendations on API security, and could be a useful contribution.
- CII Badging silver
- To handle and highlight updates for silver level.
- CII Badging update proposal
- To review proposals made for CII badging based on our risk assessment exercise. First step back of the ongoing risk assessment process, and then brainstorming regarding potential additional questions.
- Review of Casablanca priorities and Dublin priorities
- Review of the backlog for Casablanca and self-assessment of deliverables produced + focus on priorities for Dublin release- identification of tasks and their owners/leaders.
- MSB security requirements
- As MSB is crucial communication medium, it is very important to review its communication security aspects and to ensure that the transactions exchange between the different components are reliable.
- Security guidelines
- Document the security of ONAP