5gSec BluePrints

[daemon1024]

5G Deployment	Systems Security BluePrint	Network Security BluePrint	Admission Controller BluePrint
Open5gs	Link	TODO	TODO
OAI RIC
OAI RAN
Free5GC
SDRAN
SMO

• Network BluePrint - Check Internet
• RIC/RAN
• Operationalise through ArtifactHub

Doc: https://docs.google.com/spreadsheets/d/1dQoqE3OoSIb2mUKtGFdFdlcl6CMEu0AFgG95qnaXBqQ/edit?gid=0#gid=0

[PrimalPimmy]

Design + POC as a NIMBUS Report

[PrimalPimmy]

5G Blue print details and layout: https://docs.google.com/spreadsheets/d/1zYeOVeaiILnIg1U08mu69ZqhVmlrGnmM-QGV4-tjeb8/edit?usp=sharing

We are going to be using Kubescape CLI and regolibrary to generate blueprint checks.
Action items:

• Add in rego rules for the checkpoints (only first two for demo):
  • Network Policy for Ingress and Egress pods
  • Kubearmor Policies
  • TLS (more on this later)
  • Kyverno Policies
• Modify Kubescape fork to add SERAN logo and change control documentation link
• Find a way to input workload and sensitive asset input yaml through the CI into the regolibrary

[PrimalPimmy]

• Add in rego rules/controls for all necessary security checks:
  • Network Policy for Ingress and Egress pods, including checking of the the to/from pod names defined in the WorkloadConfig
  • Kubearmor Policies including the checks that all sensitive assets are protected.
  • TLS (K8tls will need a feature to generate report as a K8s resource)
  • Kyverno Policies
• Network Micro-Segmentation demo for Network Policies. Including Multi Cluster Network Policies
• Actions Items for Kubescape and Regolibrary:
  • Change name of the project Kubescape to something related to SERAN.
  • Automate blueprint controls generation and usage within the CLI instead of manually exporting it.
  • Add in whitelisting feature so that we can only focus on OAI RAN and CORE workloads (currently we can only blacklist using exceptions)
  • Better Report UI (?)
  • Change project name to SERAN related
• Deploy reports generator as a controller/job (?)