1. ONAP security meeting

2. Agenda Walkthough of the draft vulnerability management procedures
Walkthrough of potential proactive suggestions.

3. Vulnerability Management
Walk through:
Document Next Steps:
Review All. Comments by Tuesday May 31st to me.
Discuss comments for updating.
Security Vulnerability Team
Are we in a place to start getting a security vulnerability team together?
Question to take to the TSC:
How many branches will we support.
Question to David about involvement of other 3PPP security processes.

4. Proposed proactive activities
Integrate code scanning into the submission process
Define a template for a project to use in developing the security tests that have to be run on their submissions
Require all submitted code be signed
Attestation that the code is not vulnerable to the OWASP Top 10
Attestation that no default passwords are used
Attestation that no backdoors are incorporated in the code
Monitor external code for CVEs
Mitigate all critical CVEs within x days
Mitigate all high CVEs within y days

5. Proposed proactive activities
From Catherine
FOSSology is an open source license compliance software system and toolkit.
This tool could be useful to ensure that we are not integrating any open source released under GPL, Commercial licenses, etc.
CheckMarx is offering a Static Application Security Testing (SAST) product that prevents vulnerabilities in our source code but it is unfortunately not free.
I have not yet found a similar security open source product.
Sonarqube (already part of LF ONAP infra) -
is an open source platform for continuous inspection of code quality, offering reports about security vulnerabilities.
Other reports are also provided about duplicated code, code standards, unit tests, test coverage, code complexity and bugs
Bandit is a security linter for Python source code, utilizing the ast module from the Python standard library.

6. Proposed proactive activities
From Catherine
Can we also consider the following epic - COMMON-8 - Enhanced client authentication, service discovery and authorization Open ?
From a tooling perspective, FOSSology is an open source license compliance software system and toolkit.
This tool could be useful to ensure that we are not integrating any open source released under GPL, Commercial licenses, etc.
CheckMarx is offering a Static Application Security Testing (SAST) product that prevents vulnerabilities in our source code but it is unfortunately not free.
I have not yet found a similar security open source product.

7. phil Nexuslifecycle. To support vulernability …. Periodic spotchecks
Continues checks?
Need to get to a recommendation on how the information is used.
Need to decide how we want to use the information given that it will be there running anyway.

8. Proposed activities (steve)
Guidelines/check lists to projects
Can we see if some have already been used by other OS projects

9. Proposed Activity Summary (skeleton now)
Guidence to projects:
Security checking of code as part of a release
Tooling:?
Security of components in which we rely?
Decide what we want in the “attest” vs what is in the “release” checks
How to do the compliance checking …..
David Wheeler to future meeting (phil to bring in contacts)