summaryrefslogtreecommitdiffstats
path: root/docs/opnfvsecguide/audit
diff options
context:
space:
mode:
Diffstat (limited to 'docs/opnfvsecguide/audit')
-rw-r--r--docs/opnfvsecguide/audit/audit_reqs.rst110
1 files changed, 110 insertions, 0 deletions
diff --git a/docs/opnfvsecguide/audit/audit_reqs.rst b/docs/opnfvsecguide/audit/audit_reqs.rst
new file mode 100644
index 000000000..ce76d016b
--- /dev/null
+++ b/docs/opnfvsecguide/audit/audit_reqs.rst
@@ -0,0 +1,110 @@
+Requirements references related to OPNFV Audit
+
+------------------
+Source information
+------------------
+
+http://www.etsi.org/deliver/etsi_gs/NFV-INF/001_099/003/01.01.01_60/gs_NFV-INF003v010101p.pdf
+http://www.etsi.org/deliver/etsi_gs/NFV-INF/001_099/004/01.01.01_60/gs_NFV-INF004v010101p.pdf
+
+* ETSI GS NFV-SEC 003 V1.1.1 (2014-12)
+
+ - Network Functions Virtualisation NFV);
+ - NFV Security; Security and Trust Guidance
+ - NFV-SEC-003_.
+
+
+.. _NFV-SEC-003: http://www.etsi.org/deliver/etsi_gs/NFV-SEC/001_099/003/01.01.01_60/gs_NFV-SEC003v010101p.pdf
+* ETSI GS NFV 004 V1.1.1 (2013-10)
+
+ - Network Functions Virtualisation (NFV);
+ - Virtualisation Requirements
+ - NFV-SEC-004_.
+
+.. _NFV-SEC-004: http://www.etsi.org/deliver/etsi_gs/NFV/001_099/004/01.01.01_60/gs_NFV004v010101p.pdf
+
+Requirements on Auditing framework
+----------------------------------
+
+Audit records shall be maintained within protected binary logs so that the record of
+malicious actions cannot be deleted from the logs.
+
+Necessary auditable events
+--------------------------
+
+* access control management
+
+ - Adding a user account
+ - Modifying user account
+ - Deleting a user account
+ - login event
+ - logout event
+ - IP whitelisting update
+ - IP blacklisting update
+
+* VNFC Creation
+
+ - The instantiation of a newly-defined VNFC
+ - The instantiation of a VNFC with pre-configured state
+ - The cloning of an existing VNFC
+
+* VNFC Deletion
+
+ - The deletion of VNFC and of all of its instances (e.g. snapshots, backups, archives, cloned images)
+
+* Software management
+
+ - patching e.g. opreating system, drivers, VM components
+ - dynamic updates to the configuration e.g. DNS, DHCP
+ - application software updates
+ - software component updates
+
+* Data management
+
+ - Root level access to NFVI file system
+ - User level access to NFVI file system
+ - Secured wipe, disk and memory
+ - Verified destruction
+ - Certificate revocation
+
+* VNFC Migration
+
+ - VNFC original host identity
+ - VNFC target host identity
+ - high availability
+ - recovery
+ - data-in-motion changes
+
+* Other VNFC Operational State Changes
+
+ - Hibernation, sleep, resumption, abort, restore, suspension
+ - Power-on and power-off (either physical or virtual)
+ - Integrity verification failure, crash and OS compromise
+
+* VNFC Topology Changes
+
+ - Network IP address and VLAN updates
+ - Service chaining
+ - Failover and disaster recovery
+
+* traffic inspection
+
+ - enabling virtual port mirroring
+ - enabling hypervisor introspection
+ - enabling in-line traffic inspection
+ - application insertion
+
+* initial provisioning of a public/private key pair
+
+ - Self-generation of key pairs for later validation by an external party:
+
+ - Certificate Authority
+ - VNFM
+
+ - Provision by trusted party
+
+ - network
+ - storage
+
+ - Injection by hypervisor
+