Technical vulnerabilities and remediation

1. Background:
   
   

   1. Decision has been made to fix the clients in order to provide safe clients even if not part of OpenNCP

2. 1. Then we'll start again the security test and execute component per component testing

3. Liferay:

   1. @... has solved already a number of issues & installed a new version of Liferay 6.2.0-CE-GA1).

      • has solved some of the issues in the current version (Liferay 6.2.0-CE-GA1) and results are here: https://openncp.atlassian.net/wiki/display/ncp/Liferay+Security+Issues

      • has installed locally the version 6.2-CE-GA6 (which seems to have solved some of the security issues)

      • trying to migrate the installation from previous version to the new one

      • • @... is asking if we are expecting issues with the migration?

          • Normally it should be easy. Kostas will probably be finished by tomorrow evening

          • Database:no update script, this is done automatically

      • has installed https://portswigger.net/burp/ which is a web application security testing tool in order to be able to do this testing my own, before sending it to your team in order to have faster results

   2. 1. 1. @...:
            
            

            1. Good idea to use the burp suit

         @... will be available next week to work on those issues. Kostas will contact Nathan as soon as ready

         1. Nathan recommends to have a look at the recommendations for fixes

   3. When can we execute a new test session?
      
      

      1. Only one server in DG SANTE so we need to have a look at the calendar to plan the tests

      2. @...: as from end of next week (15/02)

      3.  

         @... will check the availability of the server and will check with Marco to follow the same process and planning for the other portal
      Is it possible to have a public installation? Server not available at the moment. But Jerôme will organize a quick call with Kostas

Relaxations

1. @...: The biggest problem we have is regarding the integration with the national connector on the national infrastructure side
   
   

   1. It make sense to write a document with functional requirements and then handover it to Kostas, Joao and Jerôme

      @... proposes to start a kick off document trying to formalizing the discussions by e-mail

2. 1. What Massi needs is a fresh version of deliverable - Please see section OpenNCP TF002 - Security where the document "epSOS Security Deviations Fact Sheet" is displayed
      
      

3. How to implement and to deal with message signature?

   1. epSOS approach

   2. Current version of OpenNCP: no message signature, only assertions

   3. Question is : Do we have a secure conversation (sign every message but without the key) between NCPs? Or xml digital signature (each message is signed using the key of the identity provider)
      
      

      1. Secure conversation is relevant if we have a real conversation

      2. xml digital signature is good if we have only a few conversations => Ok for Massi because at the end we do not exchange that much messages (experience from the pilot)

   4. @...: VPN = secure network, TLS = host-to-host security, we need application-to-application security
      
      

      1. Reference to document D 3.A EED v0.8 section 4.3.5.2

   5. How/who can we decide on this topic? 

      1. Proposition of Massi:
         
         

         1. Analyse the implications of both approach

         2. Present and discuss at the Technical Committee meeting and then decide by voting

            1. need for a comparison between both approach before voting => need to prepare a document before the Technical Committee

      2. Proposition Kostas:
         
         

         1. Better to have a list of all the issues and then prioritize them

            @... will make the list and prepare a proposition for this Technical Committee on Feb 4, 2016 

      3. Both approaches could be in parallel. Choice of how to implement and priority

   6. List pros and con's on the wiki for discussions, from the page dedicated on security

      => @... will create the page
      Link to the discussion page where the team can brainstorm: Open discussion

      1. To be discussed/decided to the next Technical Committee meeting on Feb 18, 2016 .

4. Workflow manager:
   
   

   1. Component that keeps OpenNCP stateless

   2. Part of the national connector discussion.

   3. STS implementation => To be included in the priority list of issues