vania-janet/multiturn-rag-retrieval-data huggingface dataset:
About Key Protect on Satellite 

IBM® Key Protect for IBM Cloud® on Satellite is a dedicated service that allows users to more fully control their own encryption keys by deploying Key Protect into a [Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-getting-started) location where users control their own infrastructure. Key Protect on Satellite connects to a user owned and managed hardware security module (HSM), which gives users full control of the encryption keys and its operations within the HSM FIPS boundary.

In this topic, references to "Key Protect" refer to the Key Protect on Satellite service.

As protecting data everywhere becomes increasingly critical for organizations transforming into hybrid Cloud IT, IBM Cloud is introducing the ability for Key Protect to support data encryption on the new Satellite environments. Key Protect on Satellite enables secure data services closer to where they are needed, with the additional security benefit of allowing customers to have separate and direct control of their "root of trust" with Bring Your Own Hardware Security Module (BYOHSM) capability.

To deploy Key Protect on Satellite, you must be added to the allowlist. [Contact IBM](https://www.ibm.com/contact/us/en/) to learn more.

Because Key Protect on Satellite features both a Satellite location with services (such as Key Protect) managed by IBM Cloud and infrastructure controlled by the user (including two fully user-controlled HSMs), it is designed for users who either desire or require closer control over their infrastructure (and keys) than is available with a fully managed service offering deployed on IBM Cloud. This offering includes single tenant Key Protect on Satellite that connects to two user-controlled HSMs, in contrast to the multi-tenant fully managed Key Protect in IBM Cloud.

This level of control is designed for users who want to promote internal best practices or satisfy relevant legal requirements. Users can use the same key management service on IBM Cloud Key Protect, on-prem Key Protect on Satellite, and in future hybrid cloud environments, depending on the use case. This level of control is designed for businesses and industries where closer control over infrastructure satisfies business or regulatory needs (for example, a banking consortium subject to data residency rules).
* Ensure applications can interact with the COS S3 API either via native support or with the addition of a hardware or software gateway solution.







 Security 

IBM responsibilities



* Security and monitoring of the environment as per IBM data center security guidelines.
* Encrypting client data when at-rest and in-transit between different IBM Cloud data center locations as part of resiliency options offered to clients.
* Continuous monitoring of resources to check for vulnerabilities and security breaches.



Your responsibilities



* Client controls access to IBM Cloud Object Storage provisioned resources and is responsible for ensuring access to client data is only provided to appropriate resources within the client organization.
* After retrieving data from IBM hosted Object Storage, client takes full responsibility to ensure the security and privacy of any local copies maintained.
* If applicable, manage customer provided encryption keys via S3 API or through IBM hosted key management services.
* Scanning of user data for viruses, malware, etc prior to uploading objects to the IBM Storage platform.







 Compliance 

IBM responsibilities



* IBM Cloud Object Storage to maintain controls commensurate with the compliance certifications/attestations as stated in official datasheets.



Your responsibilities



* Client responsibility to ensure and seek appropriate legal guidance in order to validate its compliance with pertinent industry compliance certifications and regulations.
* Client to ensure its use of Object Storage resources are inline with the terms and conditions set forth in the IBM Cloud Service Description and any other associated transaction documents.
SA-2 - Allocation of Resources 



  Control requirements 

The organization:

SA-2 (a)
:   Determines information security requirements for the information system or information system service in mission/business process planning;

SA-2 (b)
:   Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and

SA-2 (c)
:   Establishes a discrete line item for information security in organizational programming and budgeting documentation.





  NIST supplemental guidance 

Resource allocation for information security includes funding for the initial information system or information system service acquisition and funding for the sustainment of the system/service.
Yes. App Configuration is designed as a high availability service designed for enterprise workloads, and conforming to the [App Configuration Service Description](https://www.ibm.com/support/customer/csol/terms/?id=i126-8986detail-documentand) and the [IBM Cloud Service Level Agreement](https://cloud.ibm.com/docs/overview?topic=overview-slas) for availability. Within a single region, App Configuration is deployed across a multi-zone cluster.





 Is App Configuration secure? 

Yes. While App Configuration is not designed as a vault for secrets (use IBM Cloud Secrets Manager instead), the service itself adheres to strict security guidelines in the development process and in securing and protecting your data. The development process includes things like vulnerability scanning and remediation, periodic penetration testing, and frequent security reviews by world-class security experts. The data in App Configuration is encrypted by default both in transit and at rest. (See the App Configuration Data Processing and Protection data sheet to learn more). Additionally, you secure access to your own instances of App Configuration by using IBM Cloud Identity and Access Management (IAM). You can use IBM Cloud Security and Compliance Center for ongoing security monitoring and alerts for your App Configuration instances.
A catalog in which approvals for publishing and lifecycle actions are bypassed so that it can be used for testing APIs under development.





 scale 

To increase platform (or system) capacity by adding more application or service instances





 SCM 

See [source control management](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx3579285).





 scope 

A grouping of resources that can be validated or evaluated for security and compliance. See also [rule](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2037526), [profile](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2034950).





 secret 

A type of sensitive information, such as a password or an API key, that is used by an application to access a protected resource. See also [dynamic secret](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx9968958).





 secret group 

The environment and constraints that contained secrets in an instance must adhere to. A user can be associated with a secret group to enable access and collaboration.





 secrets engine 

A component that serves as a back end for a specific type of secret, such as a password or an API key, within a secrets management service. Depending on its type, a secrets engine can store data, generate secrets on demand, and more. See also [dynamic secret](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx9968958).





 Secure Shell (SSH) 

A network protocol for secure data exchange between two networked devices. The client can use public-key and private-key authentication, or password authentication, to access the remote server.





 Secure Sockets Layer (SSL) 

A security protocol that provides communication privacy. With SSL, client/server applications can communicate in a way that is designed to prevent eavesdropping, tampering, and message forgery.
Security assessments: (i) ensure that information security is built into organizational information systems; (ii) identify weaknesses and deficiencies early in the development process; (iii) provide essential information needed to make risk-based decisions as part of security authorization processes; and (iv) ensure compliance to vulnerability mitigation procedures. Assessments are conducted on the implemented security controls from Appendix F (main catalog) and Appendix G (Program Management controls) as documented in System Security Plans and Information Security Program Plans. Organizations can use other types of assessment activities such as vulnerability scanning and system monitoring to maintain the security posture of information systems during the entire life cycle. Security assessment reports document assessment results in sufficient detail as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the security controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security requirements. The FISMA requirement for assessing security controls at least annually does not require additional assessment activities to those activities already in place in organizational security authorization processes. Security assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted. For example, assessments conducted in support of security authorization decisions are provided to authorizing officials or authorizing official designated representatives. To satisfy annual assessment requirements, organizations can use assessment results from the following sources: (i) initial or ongoing information system authorizations; (ii) continuous monitoring; or (iii) system development life cycle activities. Organizations ensure that security assessment results are current, relevant to the determination of security control effectiveness, and obtained with the appropriate level of assessor independence. Existing security control assessment results can be reused to the extent that the results are still valid and can also be supplemented with additional assessments as needed. Subsequent to initial authorizations and in accordance with OMB policy, organizations assess security controls during continuous monitoring. Organizations establish the frequency for ongoing security control assessments in accordance with organizational continuous monitoring strategies. Information Assurance Vulnerability Alerts provide useful examples of vulnerability mitigation procedures. External audits (e.g., audits by external entities such as regulatory agencies) are outside the scope of this control.
The Settings tab contains the UI for many of the tunable settings for your deployment. You can



* view encryption details. Encryption at rest is enabled for all Messages for RabbitMQ deployments. If you brought your own encryption key from [Key Protect](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=cloud-databases-key-protect), the panel provides a link to your Key Protect instance and the Encryption Key field has the name of the key.
* [Change the admin password](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-admin-password)
* [Implement or modify an IP allowlist](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=cloud-databases-allowlisting)







 Service Credentials 

You can generate a new set of credentials for cases where you want to manually [connect an app](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-ibmcloud-app) or [external consumer](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-external-app) to an IBM Cloud service. [Learn more](https://cloud.ibm.com/docs/account?topic=account-service_credentials).





 Connections 

Shows connected resources. You can use the Create connection button to bind this service to another resource.





 View docs 

The View docs link from the Actions drop list opens the main documentation page for Messages for RabbitMQ in a new tab.
The division of responsibilities between the end-user and IBM for the Key Protect on Satellite service are derived from the responsibilities inherent in Satellite itself, which can be found in [Your responsibilities](https://cloud.ibm.com/docs/satellite?topic=satellite-responsibilities). Study this document carefully, as it outlines a number of important considerations and preparations a user must keep in mind when operating any service on Satellite.

In addition to understanding the responsibilities when using Satellite, there are a number of specific considerations to keep in mind when operating Key Protect on Satellite.

If you're familiar with [Understanding your responsibilities with using Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-shared-responsibilities) (the fully managed Key Protect on IBM Cloud service), you know that using Key Protect on Satellite shifts several responsibilities from IBM to you.

User responsibilities:



* Ensure your HSM is properly configured to work with Key Protect. The details of the process to configure your HSM can only be obtained by contacting IBM directly. Check out [Deploying or modifying an HSM to work with Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-aboutsatellite-about-HSM) for more information.
* Allocate worker nodes and HSM as specified in [Before you begin](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-aboutsatellite-about-before-begin).
* Ensure network connectivity between HSM and worker nodes has been established.
* Provision Key Protect on Satellite using the instructions in [Deploying Key Protect on Satellite](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-ui-deploy).
PE-4 - Access Control for Transmission Medium 



  Control requirements 

PE-4 - 0
:   The organization controls physical access to [Assignment: organization-defined information system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security safeguards].





  NIST supplemental guidance 

Physical security safeguards applied to information system distribution and transmission lines help to prevent accidental damage, disruption, and physical tampering. In addition, physical safeguards may be necessary to help prevent eavesdropping or in transit modification of unencrypted transmissions. Security safeguards to control physical access to system distribution and transmission lines include, for example: (i) locked wiring closets; (ii) disconnected or locked spare jacks; and/or (iii) protection of cabling by conduit or cable trays.
As digital wallets are targeted by hackers, it is important that the digital assets be protected in an environment that is also easily accessible by the user (known as a "hot wallet"). A protected environment is an environment where both privileged admins and external threats cannot compromise the data, thru encryption and other mechanisms. In addition, the application must be built in a secure environment that uses a Secure Build process that prevents malicious actors from tampering the application code and application image. Without a Secure Build process, a malicious insider or external actor could try to manipulate the build process or the build environment.

The Digital Wallet application, Secure Bitcoin Wallet, is available [here](https://github.com/IBM/secure-bitcoin-wallet), refer the README.md in the repository for more information. The application consists of an Electrum Bitcoin Client backend and a web front end. The backend, a modified version of Electrum, runs as a JSON RPC server to maintain a bitcoin wallet by interacting with the bitcoin network. The front end runs as a web front end to interact with bitcoin users in a web browser.





 Before you begin 

To complete this tutorial, you need to meet the following prerequisites:



* Create an IBM Cloud account.
* Download and install the IBM Cloud CLI on your workstation.
* Install [GPG](https://www.gnupg.org/index.html).







 Task flow 

To complete this solution, you walk through the following steps:



1. [Set up the IBM Container Registry](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_serversetupconreg_sbs).
2. [Set up the Secure Build Server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_serversetupsbs_sbs).
3.
SC-4 - Information in Shared Resources 



  Control requirements 

SC-4 - 0
:   The information system prevents unauthorized and unintended information transfer via shared system resources.





  NIST supplemental guidance 

This control prevents information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This control does not address: (i) information remanence which refers to residual representation of data that has been nominally erased or removed; (ii) covert channels (including storage and/or timing channels) where shared resources are manipulated to violate information flow restrictions; or (iii) components within information systems for which there are only single users/roles.
Sysdig Secure documentation 

More documentation is available for IBM Cloud® Security and Compliance Center Workload Protection functionality.

IBM Cloud Security and Compliance Center Workload Protection implements Sysdig Secure functionality. Information that is provided by the Sysdig Secure documentation applies to Workload Protection as well.

For more information, see:



*  [Sysdig Secure product page](https://sysdig.com/products/monitor/)
*  [Sysdig Secure documentation](https://docs.sysdig.com/en/sysdig-secure.html)
Security and regulation compliance includes tasks such as security controls implementation and compliance certification.



Table 4. Responsibilites for security and regulation compliance
The rows are read from left to right. The first column describes the task that the customer or IBM might be responsibility for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 IBM Responsibilities Your Responsibilities 

 Meet security and compliance objectives Provide a secure service that complies with key standards. For more information about data security, see [How do I know that my data is safe](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-security)? Ensure that you are properly securing your workloads and data so that you are meeting the regulatory standards for your organization. For more information about bucket requirements for results storage, see [Storing and processing data](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-storage). 







 Disaster recovery 

Disaster recovery includes tasks such as providing dependencies on disaster recovery sites, provision disaster recovery environments, data and configuration backup, replicating data and configuration to the disaster recovery environment, and failover on disaster events.



Table 5. Responsibilites for disaster recovery
The rows are read from left to right. The first column describes the task that the customer or IBM might be responsibility for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 IBM responsibilities Your responsibilities 

 Back up of management and configuration data Conduct backups of configurations such as attachments and scan settings. 
 Back up of scan results Conduct backups of your Cloud Object Storage data according to best practices. 
 Recovery of configuration Conduct recovery in the original region when availability is returned. 
 Recovery of scan results Conduct recovery of your Cloud Object Storage data according to best practices.
It’s recommended to use a trusted profile, but you can use an API key or an existing secret to [authorize a project to deploy](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-authorize-project) in an account. 







 Security and regulation compliance 

Security and regulation compliance includes tasks such as security controls implementation and compliance certification.



Table 4. Responsibilities for security and regulation compliance
The first column describes the task that a customer or IBM might be responsibility for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM Responsibilities Your Responsibilities 

 Apply patches and security updates to operating system in customer instances IBM notifies you of updates. Customer must apply all updates. 
 Install software and OS patches into customer-managed virtual machines N/A Customer must apply all patches. 
 Meet security and compliance objectives Provide a secure deployable architecture that complies with declared standards. For more information about data security, see [How do I know that my data is safe?](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-security). Secure your workloads and data. Integrate tools into your toolchains that satisfy your security and compliance requirements. To learn more about securing your cloud apps, see [Security to safeguard and monitor your cloud apps](https://www.ibm.com/cloud/architecture/architecture/practices/securing-cloud-native-apps-risks-mitigation/). 







 Disaster recovery 

Disaster recovery includes tasks such as providing dependencies on disaster recovery sites, provision disaster recovery environments, data and configuration backup, replicating data and configuration to the disaster recovery environment, and failover on disaster events.



Table 5. Responsibilities for disaster recovery
The first column describes the task that a customer or IBM might be responsibility for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM Responsibilities Your Responsibilities 

 Meet disaster recovery objectives IBM follows best practices for disaster recovery. All IBM applications automatically recover and restart after any disaster event.
PM-10 - Security Authorization Process 



  Control requirements 

The organization:

PM-10 (a)
:   Manages (i.e., documents, tracks, and reports) the security state of organizational information systems and the environments in which those systems operate through security authorization processes;

PM-10 (b)
:   Designates individuals to fulfill specific roles and responsibilities within the organizational risk management process; and

PM-10 (c)
:   Fully integrates the security authorization processes into an organization-wide risk management program.