Hi, Returning to the described practice in our charter I am sending the security sub-committee report. There are a few things that I would like to highlight.
Today we had a debrief from Pierre Close and Xue Gao from the CLAMP team about their experience of going applying for the passing level badg of the CII badging program. The feedback was much appreciated and a few key takeaways were (link to presentation is here: https://wiki.onap.org/download/attachments/11928162/CII%20Badging%20Program%20-%20Feedback.pptx?api=v2 ): * The self assessment style of approach is appreciated by the team. The effort does payback in terms of raising questions for improving the ways of working * It was felt that when a few teams get onto this, we will develop a common language and procedures across onap for security (and basic) procedures. * CLAMP sits at 83% approaval for the passing level, with some of the big open questions currently topics of discussion in the security sub-committee. One question that was raised is what is our KPI for responding to identified vulnerabilities. The suggestion was 60 days, that was 60 days from notification of receipt to onap fix. IF there are no objections from the TSC members or community I would like to recommend that we adopt that. I would also like to highlight that we want to capture where we are in our discussions - so we have made two child wiki pages. * One for recommendations: (which is not so much now) so I will leave ou the link. * One for recommendation development to capture our discussion in motion as we move towards alignment and proposal maturity. We are currently focusing on two topics here: 1. Static code scanning and 2. Credential management. All input is appreciated. * https://wiki.onap.org/display/DW/ONAP+security+Recomendation+Developement Best Regards, Steve. [Ericsson]<http://www.ericsson.com/> STEPHEN TERRILL Technology Specialist DUIC, Systems and Technology Development Unit IP & Cloud Business Unit, IT & Cloud Products Ericsson Ericsson R&D Center, via de los Poblados 13 28033, Madrid, Spain Phone +34 339 3005 Mobile +34 609 168 515 [email protected] www.ericsson.com [http://www.ericsson.com/current_campaign]<http://www.ericsson.com/current_campaign> Legal entity: Ericsson España S.A, compay registration number ESA288568603. This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>
_______________________________________________ ONAP-TSC mailing list [email protected] https://lists.onap.org/mailman/listinfo/onap-tsc
