Research for security related standards

[josephineSei]

In the context of secustack we analyzed OpenStack thoroughly and wrote a document showing the results. As this was done in 2017, I will go through that document again and check all the information whether they are still relevant in current OpenStack releases. This research will also result in a focus on certain standards or even new options for standards.

Research took place from 07.03.2024 to 11.03.2024
Mail with detailed documents was sent to Kurt, Dominik and Felix

[josephineSei]

Issues that were created after the research:

Floating IP Behavior: SovereignCloudStack/issues#582
Barbican Plugins: #509
User Data Backups: #541
Secure Communication Standard: #547
Image Encryption: #560

Issues that got more focus after the research:
Security Groups, Network (Neutron Policies)

[josephineSei]

For the Open Operations Round, we will present a talk about our findings about security in OpenStack and SCS.

[markus-hentsch]

For the Open Operations Round, we will present a talk about our findings about security in OpenStack and SCS.

Based on the initial slides you sent me I created some additional figures and slide content for the talk and sent them back to you.

[josephineSei]

The last thing that was added were issues for security related updates. The IaaS standard is currently under development: #749

Other issues were opened for Hardware, Operatin System Layer and KaaS Layer.

Overall we already added:

• Key manager Standard (Standardize List of allowed Barbican Plugins #509)
• Standards for Default Rules of Security Groups
• Taxonomy of Failsafe Levels

I think this issue can be closed as we already have accomplished things and are aware of them.