ONAP security meeting 2017-10-11

Agenda Information Update - S3P (carrier grade) - security aspects. Re: Carrier Grade Requirements (consolidated) common authentication/authorization service (amy) Topics to advance Credential protection and management Static Code Scanning AOB

“Carrier Grade” https://wiki.onap.org/pages/viewpage.action?pageId=15998867&focusedCommentId=16001108#comment- 16001108 Security Level 0: None Level 1: CII Passing badge Level 2: CII Silver badge, plus: All internal/external system communications shall be able to be encrypted. All internal/external service calls shall have common role-based access control and authorization. Level 3: CII Gold badge  Meeting reflection From a release perspective we could have a % per release Question: Will the arch team follow-up on this or does the seccom team do that. .

common authentication/authorization service (amy) Meeting notes Using the credentials for secure communication Create entry in the best practices development wiki for secure communication.

Next Week Feedback on maturity of overall platform. Credential Management. Try to close. Static code scanning f/b from coverity.

CII Badging programe feedback from clamp The slides were presented. The self assessment approach is appreciated Facilitated the project to improve its way of working Was seen that it can provide an common terminology and approach for security issues in ONAP CLAMP sits at 83% approval for passing level, with some of the open issues an ongoing discussion in the security sub-committee Need to come back to code coverage question.

DevEvent feedback About 10 people there, not too bad given agenda competition and flexibility. Agenda move meant that we missed feedback on CII badging program Frank Brockners raised that OPNFV has a basic scan for obvious vulnerabilities: https://git.eclipse.org/r/Documentation/prolog-cookbook.html

DevEvent feedback Phil presented nexus IQ - informs of known vulnerabilities Note: We need a proposed process for this s.

DevEvent Feedback Credential management: Static Code scanning Questions: What about user pwd/credential What about the credential for interaction with other systems. How to the plugability to the credential management. Static Code scanning How to introduce

DevEvent Other questions that came up Describe how to have secure communication between onap components Describe examples of security communication between ONAP and other systems (e.g. credentials to get access to the VIM). Describe the User provisioning and rols

Other idea Some questions we have are specific to ONAP Some cannot be new. Should we have a cross org security share’n’care meeting?