Jump to: navigation, search

Difference between revisions of "Security-SIG"

(Software Activities)
m (Advisory Activities: fix up wording for intro sentence to no longer omit advisories)
 
(32 intermediate revisions by 12 users not shown)
Line 3: Line 3:
 
<!-- #language en -->
 
<!-- #language en -->
  
Security issues, tooling, innovations and education within OpenStack are the responsibility of the Security project. The Security project is a horizontal effort within OpenStack that is comprised of what was previously referred to as the OpenStack Security Group and the Vulnerability Management Team. The Security project undertakes both technical and governance activities within OpenStack, aiming to provide guidance, information and code that enhances the overall security of the OpenStack ecosystem.
+
Security issues, tooling, innovations and education within OpenStack are the responsibility of the Security SIG. The Security SIG is a horizontal effort within OpenStack that undertakes both technical and governance activities within OpenStack, aiming to provide guidance, information and code that enhances the overall security of the OpenStack ecosystem.
 
 
[[File:SecurityProjectPillars.png|center|820px|A diagram showing the pillars of the Security project]]
 
  
 
== Organization and Contribution  ==
 
== Organization and Contribution  ==
The security group is built up primarily of two groups of people; those who write OpenStack code and those who try to secure OpenStack code! We have contributors from over 30 different companies involved in OpenStack. If you're interested in helping to make OpenStack more secure, either through writing better code, writing documentation or inventing cool new features and tooling - we want to hear from you!  
+
The Security SIG is built up primarily of two groups of people; those who write OpenStack code and those who try to secure OpenStack clouds! If you're interested in helping to make OpenStack more secure, either through writing better code, cross project collaboration, writing documentation or inventing cool new features and tooling - we want to hear from you!  
 
 
=== Organization ===
 
The Security project was recently incorporated into OpenStack under the big-tent model for collaboration. That means we're recognised by the OpenStack foundation and we govern ourselves in the same way that every other official project does. We have a Project Technical Lead (PTL), Cores and Regular members just like other projects do. The PTL is elected every six months, we meet up at each OpenStack Summit and hold our own mid-cycle meet-ups too. More regularly we meet on IRC each week to discuss progress on multiple activities. We use the [Security] tag on the standard [[https://wiki.openstack.org/wiki/Mailing_Lists#Future_Development|OpenStack developer mailing list]] when things warrant wider discussion.
 
 
 
* [[https://wiki.openstack.org/wiki/Mailing_Lists#Future_Development|OpenStack developer mailing list]]
 
* [http://eavesdrop.openstack.org/#Security_meeting Up to date IRC information]
 
* [https://webchat.freenode.net/?randomnick=1&channels=%23openstack-meeting%2C%23openstack-meeting-alt%2C%23openstack-meeting-3%2C%23openstack-meeting-4&prompt=1&uio=d4 IRC WebChat Client]
 
 
 
=== Contribution ===
 
The process of becoming a member of the group is described on the OSSG [https://launchpad.net/~openstack-ossg Launchpad page].
 
At the moment of writing, there is no defined "procedure" to get involved into the OSSG and a suggested set of steps
 
follows. Each described steps might or not be relevant depending on the individual member's background and familiarity with the OpenStack project.
 
 
 
Some steps to get started are:
 
*Read the OpenStack documentation and understand the most common deployment scenarios.
 
*Go through the [http://docs.openstack.org/trunk/openstack-compute/install/yum/content/ OpenStack installation guide] and create a deployment (either a native one or in a virtualized environment), in order to get a basic understanding of the interaction of the different OpenStack services. Some installation scripts such as [http://devstack.org/ Devstack] and [http://openstack.redhat.com/Quickstart Packstack] are readily available. However, you should not underestimate the educational benefits of spending some quality time to install OpenStack manually.
 
*Read the newly released [http://docs.openstack.org/trunk/openstack-security/content/index.html OpenStack security guide] in order to dive into the security aspects of setting up and running an OpenStack deployment.
 
*Getting acquainted to some degree with the rest of the OpenStack manuals is highly encouraged.
 
*The next step is to choose one of the OpenStack components in order to become closely familiarized with it and eventually be able to use the combined expertise of the OSSG in order to make thoughtful contributions to the component (code reviews, direct code contribution, architectural aspects) and improve its security. It is of course important to chose a component that would closely match your interests; given the size of OpenStack, becoming closely familiar with the chosen component's code base, deployment and administration practices might require significant time investments. Once you have chosen a component, send an email on the OSSG email list to let others know about your intentions.
 
 
 
See https://wiki.openstack.org/wiki/Security/How_To_Contribute for more details on how you can improve OpenStack security.
 
  
== Software Activities ==
+
=== Leadership ===
The OpenStack Security Project has a number of ongoing activities that aim to enhance security of the OpenStack cloud ecosystem. These predominantly break down into three groups; Advisory, Guidance and Software.
 
  
=== Anchor - Ephemeral PKI ===
+
The security SIG has no formal leadership, instead it has chairs who arrange meetings and organize votes. The current chair can be found listed on the [https://governance.openstack.org/sigs/ SIG governance page].
Anchor is a lightweight, open source, Public Key Infrastructure (PKI), which uses automated provisioning of short-term certificates to enable cryptographic trust in OpenStack services. Certificates are typically valid for 12-24 hours and are issued based on the result from a policy enforcing decision engine. Short term certificates enable passive revocation, to bypass the issues with the traditional revocation mechanisms used in most PKI deployments.
 
  
* [https://git.openstack.org/cgit/openstack/anchor Anchor Git Repository]
+
==== IRC ====
* [https://review.openstack.org/#/q/anchor,n,z Anchor Gerrit]
+
The security SIG has a discussion channel (#openstack-security) on the OFTC IRC network that's used for general communications, chat and the occasional user query. The security SIG meets monthly to discuss current security activities and progress on security happenings within OpenStack. We encourage new contributors to say hello during our meetings.
* [https://bugs.launchpad.net/anchor Anchor Launchpad]
 
  
=== Bandit - Python Security Linter ===
+
* [https://meetings.opendev.org/#OpenStack_Security_SIG_meeting Weekly meeting IRC information]
Bandit is a security linter for Python source code, utilizing the ast module from the Python standard library. The ast module is used to convert source code into a parsed tree of Python syntax nodes. Bandit allows users to define custom tests that are performed against those nodes. At the completion of testing, a report is generated that lists security issues identified within the target source code.
+
* [https://meetings.opendev.org/meetings/security/ Weekly meeting logs]
 
+
* [https://meetings.opendev.org/irclogs/%23openstack-security/ Logs from the #openstack-security room]
Bandit is currently a stand-alone tool which can be downloaded by end-users and run against arbitrary source code. Although early in development it is already adding value to the OpenStack code base with several projects leveraging it in their CI gate tests. As the project matures the desire is to see widespread adoption of Bandit in the OpenStack community.
+
* [https://app.element.io/#/room%2F%23oftc_%23openstack-security%3Amatrix.org Connect to #openstack-security through the Matrix-OFTC bridge]
 
 
Bandit can be obtained by cloning the repository. The README.rst file contains documentation regarding installation, usage, and configuration.
 
 
 
* [https://git.openstack.org/cgit/openstack/bandit Bandit Git Repository]
 
* [https://review.openstack.org/#/q/bandit,n,z Bandit Gerrit]
 
* [https://bugs.launchpad.net/bandit Bandit Launchpad]
 
  
 
== Advisory Activities ==
 
== Advisory Activities ==
The Security project issues Security Advisories (OSSA) and Security Notes (OSSN) both are targeted at OpenStack Users and Vendors who either run or package OpenStack for use by downstream consumers.
+
The Security SIG issues advisories and notes targeted at OpenStack Users and Vendors who either run or package OpenStack for use by downstream consumers.
 
 
=== Security Advisories - OSSA ===
 
[[File:VMTprocess.png|800px|thumbnail|center]]
 
 
 
Within the Security project exists the Vulnerability Management Team. The VMT is a small group of experienced developers who receive, triage and release fixes for vulnerabilities in OpenStack. The final stage of fixing a vulnerability is to release a Security Advisory for the community. The OSSA details the nature of the vulnerability and any workaround or patches required to mitigate it.
 
 
 
* Read more about the VMT process on [https://security.openstack.org/vmt-process.html their dedicated webpage]
 
* View the [https://security.openstack.org/ossalist.html issued OSSA list]
 
 
 
=== Security Notes - OSSN ===
 
Security Notes are designed to complement the Security Advisories issued by the Vulnerability Management Team. Security notes can be issued for almost anything affecting the security of potential OpenStack deployments. In many cases a vulnerability may be reported that cannot be fixed immediately because the fix might break the API or otherwise cause service-breaking issues for downstream consumers. Often the Security project will write notes that will guide deployers in how to best mitigate the issues when an OSSA cannot be provided. OSSNs are also issued for significant vulnerabilities in third party applications that would affect OpenStack deployments.
 
 
 
* [https://wiki.openstack.org/wiki/Security/Security_Note_Process OpenStack Security Note Process]
 
* [https://wiki.openstack.org/wiki/Security_Notes Issued Security Notes]
 
 
 
== Guidance Activities ==
 
We produce security guidance for developers and consumers of OpenStack technologies.
 
 
 
=== Security Guide ===
 
[[File:Openstack-security-guide.jpg|frameless|center]]
 
This [http://docs.openstack.org/sec/ book] was written by a close community of security experts from the OpenStack Security Project in a short, intense week-long effort at an undisclosed location. One of the goals for this book is to bring together interested members to capture their collective knowledge and give it back to the OpenStack community.
 
 
 
See http://docs.openstack.org/sec/
 
 
 
=== Security Aware Development  ===
 
Please use the resource below to help you develop more securely for OpenStack.
 
 
 
See https://github.com/openstack-security/Developer-Guidance
 
  
=== Security Blog ===
+
Advisories are typically issued by the VMT, a small group of experienced developers within the Security SIG who receive, triage and release fixes for vulnerabilities in OpenStack. The final stage of fixing a vulnerability is to release a Security Advisory for the community. The OSSA details the nature of the vulnerability and the patches required to solve it.
We're going to have a blog soon!
 
  
== Vulnerability Management Team ==
+
Security Notes are designed to complement the Security Advisories issued by the Vulnerability Management Team. Security notes can be issued for almost anything affecting the security of potential OpenStack deployments. In many cases a vulnerability may be reported that cannot be fixed immediately because the fix might break the API or otherwise cause service-breaking issues for downstream consumers. Often the Security SIG write notes that will guide deployers in how to best mitigate the issues when an OSSA cannot be provided. OSSNs are also issued for significant vulnerabilities in third party applications that would affect OpenStack deployments.
The OpenStack Vulnerability Management team is the first point of contact for OpenStack security issues. They are responsible for the vulnerability handling and disclosure process.
 
  
See http://wiki.openstack.org/VulnerabilityManagement
+
See the [https://security.openstack.org/ OpenStack security site] for the list of advisories and vulnerability management process documentation, as well as links to security note details.

Latest revision as of 17:47, 6 October 2022


Security issues, tooling, innovations and education within OpenStack are the responsibility of the Security SIG. The Security SIG is a horizontal effort within OpenStack that undertakes both technical and governance activities within OpenStack, aiming to provide guidance, information and code that enhances the overall security of the OpenStack ecosystem.

Organization and Contribution

The Security SIG is built up primarily of two groups of people; those who write OpenStack code and those who try to secure OpenStack clouds! If you're interested in helping to make OpenStack more secure, either through writing better code, cross project collaboration, writing documentation or inventing cool new features and tooling - we want to hear from you!

Leadership

The security SIG has no formal leadership, instead it has chairs who arrange meetings and organize votes. The current chair can be found listed on the SIG governance page.

IRC

The security SIG has a discussion channel (#openstack-security) on the OFTC IRC network that's used for general communications, chat and the occasional user query. The security SIG meets monthly to discuss current security activities and progress on security happenings within OpenStack. We encourage new contributors to say hello during our meetings.

Advisory Activities

The Security SIG issues advisories and notes targeted at OpenStack Users and Vendors who either run or package OpenStack for use by downstream consumers.

Advisories are typically issued by the VMT, a small group of experienced developers within the Security SIG who receive, triage and release fixes for vulnerabilities in OpenStack. The final stage of fixing a vulnerability is to release a Security Advisory for the community. The OSSA details the nature of the vulnerability and the patches required to solve it.

Security Notes are designed to complement the Security Advisories issued by the Vulnerability Management Team. Security notes can be issued for almost anything affecting the security of potential OpenStack deployments. In many cases a vulnerability may be reported that cannot be fixed immediately because the fix might break the API or otherwise cause service-breaking issues for downstream consumers. Often the Security SIG write notes that will guide deployers in how to best mitigate the issues when an OSSA cannot be provided. OSSNs are also issued for significant vulnerabilities in third party applications that would affect OpenStack deployments.

See the OpenStack security site for the list of advisories and vulnerability management process documentation, as well as links to security note details.