You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 31 Next »

This is a working document.

The below matrix is a representation of the log management categories (lifecycle) in relation to the two categories of run-time logs (logs of ONAP events, logs of events from services orchestrated by ONAP).

Team Members

Actions

30 Jul 2021

  • Amy: List of proposed events that should be collected from ONAP and Metadata
  • Muddasar: Determine if there is a standard terminology regarding logging architecture terms.  Eg., Are the categories in the above table industry accepted?

    • **There probably a body of work we can reference that spells this out.  ACTION: Literature review for that:  No standard terms, but some popular standard formats like BSD, Syslog (IETF), Common Event Format (CEF),  by Arcsight.  OWASP, NIST and Major Cloud Vendors have guidance in user docs or SDK regarding logs and formats.  NIST SP 800-92 can be found here https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf

      Application logs some time are split into Application Access and Application Operations.  Other major Category in older literature is focusing on Operating System, in Containerized deployments this can be Docker and host OS, Node logs.  We should consider listing in best practice some of these categories that do not fall within Application Container.  

      Do we need to specify format type?  WebAPIs, Datanbases and applications way have slightly different format requirements.

  • Fabian: Initial investigation of ONAP responding to security events.

13 Aug 2021

  • Review Requirements list Amy put together
  • Muddasar to provide links to NIST security logging standards: 

    https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf

  • Fabian: Initial investigation of ONAP responding to security events.
  • Bob to provide Orchestration logging events
  • Log Template as suggested by Chakir on Tuesday call ( Apache 2 log template as an example.  Can we review work from Logging enhancement project?

Key

X: Indicates what is in-scope for ONAP

BP: Indicates a best practice

P: Partially in-scope (group consensus is mixed).

Definitions:

Application: This refers to runtime containerized application
Container: This refers to the container platform and orchestration software that ONAP interfaces with.  For example, docker and K8S.

Infrastructure: This refers to any physical, virtualization, element managers, and/or operating system components.



Phase

1

(ONAP Based Events)

2

(events from services orchestrated by ONAP)



ONAP Components (e.g., DCAE, SDC, etc.)Services (xNF, xApps)

LifecycleApplication

Container

(k8s and Docker)

InfrastructureApplicationContainerInfrastructure
How they are generatedGenerationXX



How they are made availableCollectionXX




Monitoring






Alerting






ResponsePP
XX

Phase 1 will focus on logs of ONAP events.

Phase 2 will focus on logs of events from services orchestrated by ONAP

Notes

At a high level there are 5 broad categories in regards to Security Event Management (Or is this a Security Event Lifecycle?)

Generation

These below refer to the ONAP (Application and Infrastructure Columns)

Proposed Security Event Generation Requirements

[CON-LOG-REQ-1] The container and container application MUST log successful and unsuccessful authentication attempts, e.g., authentication associated with a transaction, authentication to create a session, authentication to assume elevated privilege. [Reference: R-54520]

[CON-LOG-REQ-2] The container and container application MUST log logoffs. [Reference: R-55478]

[CON-LOG-REQ-3] The container and container application MUST log starting and stopping of security logging. [Reference: R-13344]

[CON-LOG-REQ-4] The container and container application MUST log success and unsuccessful creation, removal, or change to the inherent privilege level of users. [Reference: R-07617]

[CON-LOG-REQ-5] The container and container application MUST log connections to the network listeners of the container. [Reference: R-94525]

[CON-LOG-REQ-6] The container and container application MUST log the addition and deletion of files in the container.

Proposed Required Metadata for Security Events

IDDescriptionReference
CON-LOG-REQ-7The container and container application MUST log the field “date/time” in the security audit logs. R-97445

CON-LOG-REQ-8

The container and container application MUST log the field “protocol” in the security audit logs.R-25547

CON-LOG-REQ-9

The container and container application MUST log the field “service or program used for access” in the security audit logs.R-06413

CON-LOG-REQ-10

The container and container application MUST log the field “success/failure” in the security audit logs. R-15325
CON-LOG-REQ-11The container and container application MUST log the field “Login ID” in the security audit logs. R-89474

CON-LOG-REQ-19

The container MUST be capable of automatically synchronizing the system clock daily with the Operator’s trusted time source, to assure accurate time reporting in log files. It is recommended that Coordinated Universal Time (UTC) be used where possible to eliminate ambiguity owing to daylight savings time.R-629534











Best Practices and Risk Analysis for an Operator

<TODO>

Best Practices for operators to collect and correlate logs

<TODO>

Tagging

Muddasar put your thoughts here :Adding metadata or label tags close to log source or by the log source is a good practice.  Tags can be added by a local driver for Service and Container ID/name (fqdn) as logs received by logging driver.  As ONAP XNF containers will log to stdout/stderr I/O streams, a host or sidecar based collector should be able to add tags for sending source prior to moving the logs to centralized collection location. 

As part of log generation other information elements can be added by the application.  we should consider what needs to be a requirement:  Event_Type (Access, Operation, Error).  Logging enahncement project in the past listed format and options, see Logging Enhancements Project Proposal.

Collection

Proposed Collection of Container Logs

[CON-LOG-REQ-13] The container MUST have security logging for the container and container application active from initialization. [Reference: R-84160]

[CON-LOG-REQ-20] The container and container application MUST use the STDOUT for security logs collection [Reference: REQ-374]

Data Stewardship

What is the data life cycle within ONAP?

What happens to the data as it goes to log stash?

Will it go to AAI?

TODO: Draw out a few scenarios

If there is no consumer it may be written to archive.

Archival data vs live data

Monitoring

  • Includes Enrichment, Analysis, and Reporting.
  • It is expected that this function out of scope for ONAP.  A CSP / MNO will make used of a SIEM.  ONAP's role is to provide a means to export security event data.  This is where analytics are stored and applied to the data the is ingested from ONAP.
  • Presentation by Fabian pertaining to Analysis: ONAP Logs Security Managment1.pptx 

 Alerting

  • Possibly to include mitigation and actions.   
  • If we expect ONAP to respond to security events in a closed loop manner, then there needs to be a way for events generated by the SIEM to be ingested back into ONAP.

Response

Comments from Chakar, paraphrased, (7/20/2021 SECCOM Meeting)

  • We need to disambiguate "Logging" vs "Data Collection".
  • Logging from ONAP and Logging from xNF are not the same.

There are two types of responses to consider.

  • ONAP responding to a security event in a service.
  • ONAP responding to a security event within ONAP.  ONAP's ability to respond to itself is only possible in some limited and specific situations.  What are these situations?

Terms

This is place where we can standardize our language.

  • Security Data: This is raw data that by itself may not be enough to indicate a security event.
  • Security Event: 
  • Analytic

QUESTIONS (Or Advanced Use Cases)

  1. In terms of security logging, should we handle ONAP components differently than Service Components hosted in ONAP?
    Muddasar: Any transections carried out for a service(5G, virtualization and SDN) should generate Application Logs  by ONAP Containers.  I would think life cycle management of a service (instantiation and changes) may have some information buried in the ONAP logs.  Transections events for service design, service deployment within and outside the ONAP components  thru ONAP APIs should be part of the ONAP logging.  
  2. How do we handle the use case where ONAP is being used to deploy and manage a security infrastructure?
    Muddasar: I think it may be similar to above.  I think ONAP will not be used to do OAM of security infrastructure, with exception that ONAP may play a role in the instantiation of some of security network elements.  Example:  A service design may require deployment of FW/IDS/IPS.  ONAP transection may be limited to requesting VIMs/EMs  to deploy/change network elements and perhaps deploy base configuration.  Logs generated by network elements may flow thru a different path(different virtualized enclaves) to a different collector similar to XNFs.  
  3. What about security events in regards to the closed loop model?  Adversarial AI will be an issue that will need security monitoring in the near future.  Does this mean that orchestration / life cycle data from the DCAE needs to ingested by a SIEM?
    Muddasar:  I believe Data Exposure Service (DES) can provide this facility.  I think question here should be that once logs are created, are there any internal ONAP consumers for that information?  

References

  1. https://www.enisa.europa.eu/publications/security-in-5g-specifications
  2. https://www.enisa.europa.eu/publications/enisa-threat-landscape-report-for-5g-networks

Attachments


  • No labels