This is a working document.

Notes

At a high level there are 4 broad categories in regards to Security Event Management (Or is this a Security Event Lifecycle?)

**There probably a body of work we can reference that spells this out.  ACTION: Literature review for that

• Generation
  • Within ONAP both containers and infrastructure generate raw data that have security concerns.
    • Containers (xNFs)
      • There currently a SECCOM proposal that specify what type of data should be logged where it should be logged to.  In this case STDOUT
        • TODO: List STDOUT REQ NUMBER HERE
      • That is documented here: https://wiki.onap.org/download/attachments/100895473/2021-02-22_LoggingRequirementEvents_v9.pptx?version=1&modificationDate=1619018452000&api=v2
    • Infrastructure (Docker and K8S)
      • There are a set of logs that both Docker and K8S generate that relate to security monitoring.
      •  That is documented here: https://wiki.onap.org/download/attachments/103419713/Logging%20-%20ATTACK%20to%20SECCOM_v3.pptx?version=1&modificationDate=1622560207000&api=v2
• Collection
  • How these logs would be collected and aggregated is specified by the ONAP NextGen Presentation by Byung.
  • https://wiki.onap.org/download/attachments/103416997/ONAP-Next-Generation-Security-Logging-2021-5-25-v1.pptx?version=1&modificationDate=1621953519000&api=v2
• Analysis
  • It is expected that this function out of scope for ONAP.  A CSP / MNO will make used of a SIEM.  ONAP's role is to provide a means to export security event data.  This is where analytics are stored and applied to the data the is ingested from ONAP.
• Action
  • If we expect ONAP to respond to security events in a closed loop manner, then there needs to be a way for events generated by the SIEM to be ingested back into ONAP.

Terms

This is place where we can standardize our language.

• Security Data: This is raw data that by itself may not be enough to indicate a security event.
• Security Event: 
• Analytic

QUESTIONS

1. In terms of security logging, should we handle ONAP components differently than Service Components hosted in ONAP?
2. How do we handle the use case where ONAP is being used to deploy and manage a security infrastructure?
3. What about security events in regards to the closed loop model?  Adversarial AI will be an issue that will need security monitoring in the near future.  Does this mean that orchestration / life cycle data from the DCAE needs to ingested by a SIEM?

References

1. https://www.enisa.europa.eu/publications/security-in-5g-specifications
2. https://www.enisa.europa.eu/publications/enisa-threat-landscape-report-for-5g-networks