`<< Back <../../openstack>`__ .. _2-architecture-requirements: 2. Architecture Requirements ============================ .. raw:: html

Dickering over the final points

Table 2-1a: Reference Model Requirements: Cloud Infrastructure Software Profile Capabilities

Table 2-1b: Cloud Infrastructure Software Profile Extensions Requirements for Compute

Table 2-2a: Reference Model Requirements - Virtual Networking

The required number of connection points to a VM is described in ``e.cap.004`` `above <#2.2.1>`__. The table below specifies the required bandwidth of those connection points. +-------------+-------------+-------------+-------------+-------------+ | Reference | Description | Requirement | Requirement | Sp | | | | for Basic | for High | ecification | | | | Profile | Performance | Reference | | | | | Profile | | +=============+=============+=============+=============+=============+ | n1, n2, n3, | 1, 2, 3, 4, | Must | Must | | | n4, n5, n6 | 5, 6 Gbps | support | support | | +-------------+-------------+-------------+-------------+-------------+ | n10, n20, | 10, 20, 30, | Must | Must | | | n30, n40, | 40, 50, 60 | support | support | | | n50, n60 | Gbps | | | | +-------------+-------------+-------------+-------------+-------------+ | n25, n50, | 25, 50, 75, | Optional | Must | | | n75, n100, | 100, 125, | | support | | | n125, n150 | 150 Gbps | | | | +-------------+-------------+-------------+-------------+-------------+ | n50, n100, | 50, 100, | Optional | Must | | | n150, n200, | 150, 200, | | support | | | n250, n300 | 250, 300 | | | | | | Gbps | | | | +-------------+-------------+-------------+-------------+-------------+ | n100, n200, | 100, 200, | Optional | Must | | | n300, n400, | 300, 400, | | support | | | n500, n600 | 500, 600 | | | | | | Gbps | | | | +-------------+-------------+-------------+-------------+-------------+ .. raw:: html

Table 2-2b: Reference Model Requirements - Network Interface Specifications

Table 2-2c: Cloud Infrastructure Software Profile Extensions Requirements for Networking

Table 2-3a: Reference Model Requirements - Cloud Infrastructure Software Profile Requirements for Storage

Table 2-3b: Reference Model Requirements - Cloud Infrastructure Software Profile Extensions Requirements for Storage

Table 2-4a: Reference Model Requirements - Cloud Infrastructure Hardware Profile Requirements

Table 2-4b: Reference Model Requirements - Cloud Infrastructure Hardware Profile Extensions Requirements

Table 2-5: Reference Model Requirements: Cloud Infrastructure Management Requirements

Table 2-6: Reference Model Requirements - System Hardening Requirements

Table 2-7: Reference Model Requirements - Platform and Access Requirements

Table 2-8: Reference Model Requirements: Confidentiality and Integrity Requirements

Table 2-9: Reference Model Requirements - Workload Security Requirements

Table 2-10: Reference Model Requirements - Image Security Requirements

Table 2-11: Reference Model Requirements - Security LCM Requirements

Table 2-12: Reference Model Requirements - Monitoring and Security Audit Requirements

Table 2-13: Reference Model Requirements - Open-Source Software Security Requirements

Table 2-14: Reference Model Requirements: IaaC Security Requirements, Secure Code Stage

Table 2-15: Reference Model Requirements - IaaC Security Requirements, Continuous Build, Integration and Testing Stage

Table 2-16: Reference Model Requirements - IaaC Security Requirements, Continuous Delivery and Deployment Stage

Table 2-17: Reference Model Requirements - IaaC Security Requirements, Runtime Defence and Monitoring Stage

Table 2-18: Reference Model Requirements: Cloud Infrastructure Security Requirements

Table 2-19: General Requirements

Table 2-20: Infrastructure Requirements

Table 2-21: VIM Requirements

Table 2-22: Interfaces and APIs Requirements

Table 2-23: Tenant Requirements

Table 2-24: LCM Requirements

Table 2-25: Assurance Requirements

Table 2-26: General Recommendations

Table 2-27: Infrastructure Recommendations

Table 2-28: VIM Recommendations

Table 2-29: Interfaces and APIs Recommendations

.. _245-tenant-recommendations: 2.4.5 Tenant Recommendations ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This section is left blank for future use. ===== ============ =========== ===== Ref # sub-category Description Notes ===== ============ =========== ===== ===== ============ =========== ===== .. raw:: html

Table 2-30: Tenant Recommendations

Table 2-31: LCM Recommendations

Table 2-32: Assurance Recommendations

.. _248-security-recommendations: 2.4.8 Security Recommendations ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .. _2481-system-hardening-source-rm-791: 2.4.8.1. System Hardening (source `RM 7.9.1 <../../../ref_model/chapters/chapter07.md#791-system-hardening>`__) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +-------------+--------------+------------------------------+-------+ | Ref # | sub-category | Description | Notes | +=============+==============+==============================+=======+ | sec.gen.011 | Hardening | The Cloud Infrastructure | | | | | **should** support Read and | | | | | Write only storage | | | | | partitions (write only | | | | | permission to one or more | | | | | authorised actors). | | +-------------+--------------+------------------------------+-------+ | sec.gen.014 | Hardening | All servers part of Cloud | | | | | Infrastructure **should** | | | | | support measured boot and an | | | | | attestation server that | | | | | monitors the measurements of | | | | | the servers. | | +-------------+--------------+------------------------------+-------+ .. raw:: html

Table 2-33: System Hardening Recommendations

Table 2-34: Platform and Access Recommendations

Table 2-35: Confidentiality and Integrity Recommendations

.. _2484-workload-security-source-rm794: 2.4.8.4. Workload Security (source `RM7.9.4 <../../../ref_model/chapters/chapter07.md#794-workload-security>`__) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +------------+--------------+-------------------------------+-------+ | Ref # | sub-category | Description | Notes | +============+==============+===============================+=======+ | sec.wl.007 | Workload | The Operator **should** | | | | | implement processes and tools | | | | | to verify VNF authenticity | | | | | and integrity. | | +------------+--------------+-------------------------------+-------+ .. raw:: html

Table 2-36: Workload Security Recommendations

.. _2485-image-security-source-rm795: 2.4.8.5. Image Security (source `RM7.9.5 <../../../ref_model/chapters/chapter07.md#795-image-security>`__) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ This section is left blank for future use. ===== ============ =========== ===== Ref # sub-category Description Notes ===== ============ =========== ===== ===== ============ =========== ===== .. raw:: html

Table 2-37: Image Security Recommendations

.. _2486-security-lcm-source-rm796: 2.4.8.6. Security LCM (source `RM7.9.6 <../../../ref_model/chapters/chapter07.md#796-security-lcm>`__) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +-------------+--------------+------------------------------+-------+ | Ref # | sub-category | Description | Notes | +=============+==============+==============================+=======+ | sec.lcm.004 | LCM | The Cloud Operator | | | | | **should** support automated | | | | | templated approved changes; | | | | | Templated approved changes | | | | | for automation where | | | | | available | | +-------------+--------------+------------------------------+-------+ .. raw:: html

Table 2-38: LCM Security Recommendations

.. _2487-monitoring-and-security-audit-source-rm797: 2.4.8.7. Monitoring and Security Audit (source `RM7.9.7 <../../../ref_model/chapters/chapter07.md#797-monitoring-and-security-audit>`__) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The Platform is assumed to provide configurable alerting and notification capability and the operator is assumed to have automated systems, policies and procedures to act on alerts and notifications in a timely fashion. In the following the monitoring and logging capabilities can trigger alerts and notifications for appropriate action. +-------------+--------------+------------------------------+-------+ | Ref # | sub-category | Description | Notes | +=============+==============+==============================+=======+ | sec.mon.014 | Monitoring | The Monitoring systems | | | | | **should** not impact IaaS, | | | | | PaaS, and SaaS SLAs | | | | | including availability SLAs | | +-------------+--------------+------------------------------+-------+ | sec.mon.016 | Monitoring | The Platform Monitoring | | | | | components **should** follow | | | | | security best practices for | | | | | auditing, including secure | | | | | logging and tracing | | +-------------+--------------+------------------------------+-------+ .. raw:: html

Table 2-39: Monitoring and Security Audit Recommendations

Table 2-40: Open-Source Software Security Recommendations

Table 2-41: Reference Model Requirements: IaaC Security, Design and Architecture Stage

Table 2-42: Reference Model Requirements: IaaC Security, Secure Code Stage

Table 2-43: Reference Model Requirements: IaaC Security, Continuous Build, Integration and Testing Stage

Table 2-44: Reference Model Requirements: IaaC Security, Continuous Delivery and Deployment Stage

Table 2-45: Reference Model Requirements: Iaac Security, Runtime Defence and Monitoring Stage

Table 2-46: Security Recommendations