1. ONAP security meeting

2. Agenda Information Update-
S3P (carrier grade) - security aspects. Re: Carrier Grade Requirements (consolidated)
common authentication/authorization service (amy)
Topics to advance
Credential protection and management
Static Code Scanning
AOB

3. “Carrier Grade”
Security
Level 0: None
Level 1: CII Passing badge
Level 2: CII Silver badge, plus:
All internal/external system communications shall be able to be encrypted.
All internal/external service calls shall have common role-based access control and authorization.
Level 3: CII Gold badge 
Meeting reflection
From a release perspective we could have a % per release
Question: Will the arch team follow-up on this or does the seccom team do that. .

4. common authentication/authorization service (amy)
Meeting notes
Using the credentials for secure communication
Create entry in the best practices development wiki for secure communication.

5. Next Week Feedback on maturity of overall platform.
Credential Management. Try to close.
Static code scanning
f/b from coverity.

6. CII Badging programe feedback from clamp
The slides were presented.
The self assessment approach is appreciated
Facilitated the project to improve its way of working
Was seen that it can provide an common terminology and approach for security issues in ONAP
CLAMP sits at 83% approval for passing level, with some of the open issues an ongoing discussion in the security sub-committee
Need to come back to code coverage question.

7. DevEvent feedback
About 10 people there, not too bad given agenda competition and flexibility.
Agenda move meant that we missed feedback on CII badging program
Frank Brockners raised that OPNFV has a basic scan for obvious vulnerabilities:

8. DevEvent feedback
Phil presented nexus IQ - informs of known vulnerabilities
Note: We need a proposed process for this s.

9. DevEvent Feedback Credential management: Static Code scanning
Questions:
What about user pwd/credential
What about the credential for interaction with other systems.
How to the plugability to the credential management.
Static Code scanning
How to introduce

10. DevEvent Other questions that came up
Describe how to have secure communication between onap components
Describe examples of security communication between ONAP and other systems (e.g. credentials to get access to the VIM).
Describe the User provisioning and rols

11. Other idea Some questions we have are specific to ONAP
Some cannot be new. Should we have a cross org security share’n’care meeting?