You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

This is a working page that captures the intent and planned/ongoing actions for the support of security coordination in ONAP.  Such actions could create new wiki pages addressing specific issues.

Ongoing at the moment is to list the activities that should be initiated.  If you want to be involved, please contact Stephen.terrill@ericsson.com 

Contact names, contributing to this:LEVY, DONALD E <dl2378@att.com>; Krec, Michael <michael.krec@bell.ca>; Zygmunt Lozinski <zygmunt_lozinski@uk.ibm.com>; Don Clarke <D.Clarke@cablelabs.com>; Sood, Kapil <kapil.sood@intel.com>; Andreas Ljunggren <andreas.ljunggren@ericsson.com>; Phil Robb <probb@linuxfoundation.org>; ZWARICO, AMY <az9121@att.com>; Evgeny Zemlerub <EVGENYZE@amdocs.com>; David Jorm <david.jorm@gmail.com>; Stephen Terrill


Identified activityActivity DescriptionStatus
Creation of a Vulnerability Response Team
  • Creation of a proposed draft of the vulnerability procedures to follow when a vulnerability is identified, and the follow-up process .(David) 
    • Review in team
    • when ready, propose to TSC
  • Secure candidates of the security response team (to identify severity and where the problem might be, coordinate and bring in the experts). looking for 3-5 people that has a Knowledge of 1. process, 2. security expertise & drive/coord, 3 sufficient knowledge of code.   
    •  

Identify a Security-Adit team to audit and oversee remediation of vulnerabilities within ONAP

There are tools that can be part of the ONAP build system such as "Nexus Lifecycle", and external static scanners such as Coverity that the ONAP community can use for free to detect *potential* issues.  The audit team would need to sign up to run these tools against the codebase, and more importantly review the output for relevant issues and work with the appropriate ONAP project(s) to remediate the issue.

https://www.sonatype.com/intelligence-automation

https://scan.coverity.com/


Go through the process of implementing all the best practices identified in the Core-Infrastructure-Initiative (CII) and receive their "Badge" of approval.

https://github.com/linuxfoundation/cii-best-practices-badge  

This may identify good practices, which could include guidelines.  consider, Ensure least privilege by design), consider how to look at code scaning into the integration processes.


Identity primary relevant legislation stds to be considered. Identify the main security standards etc that are related to regulatory requirements.  This would be for awareness.  
   
  • No labels