Compliant Financial Infrastructure accelerates the development, deployment and adoption of services provided for AWS, Azure and Google in a way that meets existing regulatory and internal security controls.
License: Apache License 2.0
As raised on the Cloud Service Certification call on 30th January 2020 Ken D'Aura from The Hartford - Insurance Firm
Roadmap item : How does Cloud Service Certification maintain the security of the environment and the protection of the environment for open source consumers?
This issue describes changes to be made by @maoo at FINOS to the Cloud Service Certification team in GitHub now Peter Thomas (@peterrhysthomas) from Deutsche Bank has been approved as the CSC Lead Maintainer. See #54 #56
The changes below should happen to the following team https://github.com/orgs/finos/teams/fdx-cloud-cert/members
The FINOS team is creating an infographic that communicates how to raise a new Cloud Service Certification service contribution and needs your input to refine.
The following proof of concept demonstrates how the infographic could work. However, in order to refine fully, we call upon your experience to give thoughts, feedback and ideas.
Please put your thoughts and feedback in the comments. Also, feel free to pencil your own sketch in the comments if that helps communicate your point of view 🚀
Translate the Cloud Service Certification DynamoDB test cases into Gherkin BDD scripts using the following the DynamoDB Test Cases Documentation for reference.
DynamoDB Test Cases Documentation
Thursday 5 November 2020 - 12pm EST / 5pm UK
| Name | Firm | Comment |
|---|
Webex:
https://finos.webex.com/finos/j.php?MTID=m4b7c03efc2237c6685c1846e6d815cc3
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 127 062 3555
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Thursday 07 May 2020 - 10am EST
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
+1-415-655-0003 US Toll
+44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos-fdx/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Define the Service Approval Accelerator for PostgreSQL using the Service Approval Accelerator Template for reference.
azure\postgresql folder structure in the Cloud Services Certification project root.markdown.azure\postgresql folder .The following is the Service Approval Accelerator Template on GitHub.
Although I haven't had the privilege of directly working with Peter, I do believe he is the best fit for the Cloud Service Certification Lead Maintainer given his pedantry and his insights..
This item was discussed during #35 and relates to #37
The Service Approval Accelerator Template contains information specific to RedShift.
This item is to remove technology specific language so the Service Approval Accelerator Template is white labeled and can be applied across all service types.
As raised on the Cloud Service Certification call on 30th January 2020 : Can the work produced by the Cloud Security Alliance be brought into or shared across FINOS firms?
Raised by @abdullahgarcia
Thursday 30 July 2020 - 10am EST / 3pm BST
| Name | Firm | Comment |
|---|---|---|
| Eric Tice | Wipro | |
| Luis Lopes | Itau | @junjikatto - Does Luis have a GitHub profile so we can register in the comments? 😄 |
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
All cloud services that are contributed to Cloud Service Certification must include a standard set of artefacts for the contribution to be considered done.
This work item is to add a "New Cloud Service Request" template as markdown to the Cloud Service Certification ISSUE_TEMPLATE folder as highlighted below.
This means, for every request that's made for a new cloud service, the issue template will include the artefacts needed for the issue to be considered done when the item is picked contributed.
https://github.com/finos/cloud-service-certification/tree/master/.github/ISSUE_TEMPLATE
Cloud_service.md file in https://github.com/finos/cloud-service-certification/tree/master/.github/ISSUE_TEMPLATECloud_service.md markdown template using the MD format below---
name: <emoji_here> <template title>
about: <description>
---
## <template title>
<description of services contribution requirements>
- [ ] <service contribution requirement>
- [ ] <service contribution requirement>
- [ ] <service contribution requirement>
- [ ] <service contribution requirement>
- [ ] <service contribution requirement>
Cloud_service.md add to https://github.com/finos/cloud-service-certification/tree/master/.github/ISSUE_TEMPLATEThe following lists the artefacts required with each service request for the associated service contribution to be completed.
These should be added to the template as the <service contribution requirement>
During the Cloud Service Certification Meeting on 16th July 2020 #49 an action was taken to edit project participants in the CSC wiki. The following steps highlight activity needed to complete this request.
docs folder in the repo #50Maintainer.Contributor.Participant.project-charter.md as required.Thursday 21 May 2020 - 10am EST
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos-fdx/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
The Cloud Service Certification team requires a roadmap to be created that outlines a vision and direction for the OSS project.
This issue proposes the first iteration of roadmap as MVP to enable communication and the creation of the first team stories.
As part of our service definition for Azure, we have defined a number of common services which are shared by the native services used within application deployments. Examples of this are VNets, KeyVault, Log Analytics/Log Monitor, Private Endpoints, etc.
This issue is to clarify whether we need to document these as part of this initiative and how we should document them, for example we can include them as aspects of the other services (such as how KeyVault is used for Blob) or we can produce a stand-alone document defining these services.
Thursday 16 July 2020 - 10am EST / 3pm BST
| Name | Firm | Comment |
|---|---|---|
| Jason Nelson | JPMC | @git-hub-forwork1 - Please say hello in the comments of #49 |
| Nati Shalom | Cloudify | @natishalom - Please say hello in the comments of #49 |
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Thursday 2 July 2020 - 10am EST / 3pm BST
templates/ServiceApprovalAcceleratorTemplate.md that explains RedShift technical examples - Commit Completed by @git-hub-forwork1 on call 👍Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
To keep the CSC community updated on cloud controls, the Cloud Security Alliance CSA_CCM_v3.0 spreadsheet should be added to the CSC GitHub wiki.
This GitHub Issue is an asynchronous discussion and potential vote to help instruct the Cloud Service Certification project on the next set of cloud services to be focused upon by the team.
During the Cloud Service Certification meeting on 10th September 2020 #61 the following services were called out and suggested by the group.
Please continue the suggestions and discussion in the comments below 👇
Thursday 4th June 2020 - 10am EST / 3pm BST
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Thursday 07 May 2020 - 10am EST
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
+1-415-655-0003 US Toll
+44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos-fdx/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
@finos/fdx-cloud-cert and @git-hub-forwork1 (lol), related to finos/community#5 , what is our larger OSSF strategy? Meeting? Booth? General session?
Figure we can get the conversation started here.
In order for documentation contribution to succeed into the CSC GitHub wiki we need to prove pull requests can be raised against wiki documentation by cloning the following link ...
https://github.com/finos/cloud-service-certification.wiki.git
To accelerate the Cloud Service Certification OSS team, the first swathe of Cloud Service Certification artefacts should be contributed to the project.
The contributed artefacts should be items that clearly demonstrate the direction of the project, such as cookbooks, infrastructure as code, BDD scripts and other items of value.
The artefacts should be tested and their functionality should be utilised by the community to allow team members to replicate, demonstrate and extend their functionality.
When the artefacts have been added, an agenda item should be added to the team group call to review, hand over and invite group feedback.
When writing tests for IaC solutions, I want to have the ability to use standard language conventions that already exist in other languages so I can reuse my knowledge and best practices as part of the solution.
Using Pulumi would allow us to use common conventions that we already know with languages like Typescript and Go with Gherkin and BDD. There are already existing documented approaches to using industry standard frameworks with Pulumi like Typescript and Mocha.
This is an alternative to using specific testing frameworks that are IaC implementation specific and require learning a new framework.
Define the Service Approval Accelerator for Kubernetes using the Service Approval Accelerator Template for reference.
azure/kubernetes.mdRed Hat is committed to enable hybrid/multi-cloud. One aspect of that is compliance as code that works on prem and in multiple public clouds. Any feedback on the following frameworks and examples are appreciated.
OpenSCAP can be used to deliver compliance as code for technical controls:
https://www.open-scap.org/features/scap-components/
Red Hat's SCAP content is stored in the Compliance as Code github repository.
Directory of available content: https://github.com/ComplianceAsCode/content
Red Hat has SCAP content for OpenShift 3. That Red Hat SCAP content is inspired by the CIS Kubernetes v1.2 benchmark, and adjusted as needed to be OpenShift-specific. (You can download CIS benchmarks here: https://www.cisecurity.org/cis-benchmarks/)
You can find the list of automated checks available for OpenShift 3 here:
https://github.com/ComplianceAsCode/content/tree/master/ocp3/profiles
One of the recommendations in the CIS Kubernetes benchmark is to ensure that the etcd datastore is encrypted. You can find the OVAL code to validate that the OpenShift etcd datastore is encrypted below:
https://github.com/ComplianceAsCode/content/blob/master/applications/openshift/api-server/api_server_encryption_provider_cipher/oval/shared.xml
Finally, if you have access to an OpenShift cluster and you'd like to try out our SCAP content for OpenShift 3, you can find the content here: https://nvd.nist.gov/ncp/checklist/866
and a cheat sheet for using the scanner and content is attached.
Also, if you haven't done so already, check out the Cloud Security Alliance Cloud Controls Matrix. It provides a terrific view of the overlapping controls across many regulatory and security frameworks. You can download it here:
https://cloudsecurityalliance.org/research/cloud-controls-matrix/
We'll be working next on building SCAP content for NIST 800-53 controls for OpenShift 4.
Thursday 10 September 2020 - 10am EST / 3pm BST
| Name | Firm | Comment |
|---|---|---|
| Alessandro Petroni | RedHat | @apetroni - Can you register yourself in the comments below 👇 😄 |
| Alfred Tommy | Searce | @alfredtommy - Can you register yourself in the comments below 👇 😄 |
| Junji Katto | Itaú | @junjikatto - Can you register yourself in the comments below 👇 😄 |
| Pedro Henrique Toth | Itaú |
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Currently, documents are written in Markdown. They use a lot of tables, but Markdown table syntax is quite restrictive and doesn't let you have any multi-paragraph or block elements in a table cell. To work around this, HTML is used, which make the documents harder to read/edit in plain text.
GitHub can render a few different markup languages, and one of these is Asciidoc (with Asciidoctor; extension .adoc). This supports quite flexible table syntax, as well as automatic tables of contents and other more sophisticated document features, so might be worth evaluating.
It's been noticed by Cloud Service Certification team members that a Google Group exists but is not being publicly advertised or is not easily found.
To mitigate this issue, a link to the Cloud Service Certification Google Group should be added to the GitHub wiki so it can be found close to the project:
https://groups.google.com/a/finos.org/forum/#!topic/fdx-cloud-service-certification/1RPUvv18ksA
Cloud Platform Target: GCP
The directory in which the Cloud Service will reside (/gcp/gke).
The name of the service: IaaC (Terraform) for GKE
Description: Tested and validated terraform script(s) for deployment of GKE cluster and node pools as per security and networking best practices.
Thursday 19 November 2020 - 10am EST / 3pm GMT
| Name | Firm | Comment |
|---|
Functional versus Declarative BDD Testing Examples and produce examples of Functional versus Declarative BDD Testing to share with the CSC project for wider input and feedback.Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Thursday 22 October 2020 - 10am EST / 3pm BST
| Name | Firm | Comment |
|---|---|---|
| Alexander Molev | Cloudify |
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
To come ...
For : Freddie from DB
Define the Control Framework for PostgreSQL using the CSC Control Spreadsheet for reference.
azure\postgresql folder structure in the Cloud Services Certification project root.markdown.azure\postgresql folder .The following is the CSC Control Spreadsheet Template on GitHub.
Define the Service Approval Accelerator for Blob Storage using the Service Approval Accelerator Template for reference.
I would like input from interested parties around AWS EventBridge for the next cloud service certification artefacts for AWS.
I am providing some links to the community to review and get educated on this service if they are not already familiar.
https://aws.amazon.com/eventbridge/
https://www.youtube.com/watch?v=28B4L1fnnGM
https://www.serverless.com/blog/eventbridge-use-cases-and-tutorial/
These should provide enough high level and detail to get you started towards understanding this service and allow for collaboration on building artefacts for the Service Certification.
The last link provides some specific detail about use cases so that it is clear this managed service is basically Cloudwatch under the covers with cron functions and a rules engine for multiple sources and destinations.
It's been reported that on-boarding into the Cloud Service Certification working group can be confusing and disjointed.
For example, if you Google "FINOS Cloud Certification" you will most likely land on the GitHub page:
https://github.com/finos/cloud-service-certification
However, much of the important background information is found on the following Confluence page which the GitHub project doesn't link to:
https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Discovering relevant information about the project, meetings, mailing lists, locating the code and wiki can be a challenge.
The potential resolution to this issue is to migrate related group information into the GitHub Cloud Service Certification repository and make sure all references and links point to GitHub.
This makes sure all related project information is together in a single place and is also good for Google which tends to point to the GitHub repo when searching the project.
It would be good to get further comments and thoughts from the Cloud Service Certification group before a decision to action is made.
This story is to integrate Service Approval Accelerator Template feedback as supplied by @danizheleva and @alfredtommy during Cloud Service Certification meeting #35
We have done some work to review Service Approval Accelerator Template. Since we cannot raise a PR with proposed structure change, I am posting on here for visibility for the group.
Overall there was a good overlap with the information in the template and the categories we have looked at for Azure services. Some changes could perhaps be to add some extra detail to the table in the document in the following way:
My suggestion for additional categories in the template:
Thursday 13 August 2020 - 10am EST / 3pm BST
| Name | Firm | Comment |
|---|---|---|
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Thursday 18th June 2020 - 10am EST / 3pm BST
| Name | Firm | Comment |
|---|---|---|
| Luis Maciel | Itau | |
| Eduardo Damiani | Itau |
templates/ServiceApprovalAcceleratorTemplate.md that explains RedShift technical examples - Commit Completed by @git-hub-forwork1 on call 👍Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Thursday 8 October 2020 - 10am EST / 3pm BST
| Name | Firm | Comment |
|---|---|---|
| Gabriele Columbro | FINOS | @mindthegab |
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Project prerequisites and dependencies to be added to GitHub issues for the community to pick up and contribute in preparation for the addition of more cloud services contributions. So ...
In the future, when Cloud Service Certification collaborators join the project, they know what needs to be contributed so the project team can move forward with adding additional cloud services.
Add top three contributions needed from the community to GitHub issues that allow the additional cloud services to move forward.
@pudern and @alfredtommy from Searce to create, lead and deliver a Cloud Service Certification service that introduces and demonstrates GCP Security Command Center Service to CSC.
A new cloud service must follow the standard completion template. The 'definition of done' of a cloud service request is defined as follows:
The directory in which the Cloud Service will reside (/<cloud_platform>/<service_name>).
The name of the service.
The written definition of a compliant service, including security, regulatory and quality standards for that service.
Test cases to be created to prove the integrity of the given service. These tests will form the service controls.
Terraform or YAML scripts to provision resources in keeping with the control framework.
BDD feature scripts that map the defined test cases onto the control framework.
Thursday 27th Aug 2020 - 10am EST / 3pm BST
Convene, roll call, welcome new people
Review action items from previous meetings
Approve previous meeting minutes - #56
Discussion of infographic, FAQ and intro documentation #55
Discussion on referencing documentation/code in other repositories
Discussion on OSS Forum
Discussion on initial contributions from CodeThink
AOB, Q&A & Adjourn (5mins)
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
Thursday 24 September 2020 - 10am EST / 3pm BST
| Name | Firm | Comment |
|---|
Webex:
https://finos.webex.com/finos/j.php?MTID=me0b8e6061812f875505b0caaceac3321
Dial-in
US +1-415-655-0003 US Toll
UK +44-20319-88141 UK Toll
Access code: 662 732 581
Github Repo: https://github.com/finos/cloud-service-certification/
Project Wiki Page: https://finosfoundation.atlassian.net/wiki/spaces/FDX/pages/904626436/Cloud+Service+Certification+Project
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.