vania-janet/multiturn-rag-retrieval-data huggingface dataset:
SI-2 (d) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts<br> * Check whether DevSecOps Toolchain passes unit tests to validate all code changes<br> * Check whether DevSecOps Toolchain passes acceptance tests to validate every deployment<br> * Check whether DevSecOps Toolchain signs build artifacts to attest their provenance<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br> 







 NIST supplemental guidance 

Organizations identify information systems affected by announced software flaws including potential vulnerabilities resulting from those flaws, and report this information to designated organizational personnel with information security responsibilities. Security-relevant software updates include, for example, patches, service packs, hot fixes, and anti-virus signatures. Organizations also address flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations take advantage of available resources such as the Common Weakness Enumeration (CWE) or Common Vulnerabilities and Exposures (CVE) databases in remediating flaws discovered in organizational information systems. By incorporating flaw remediation into ongoing configuration management processes, required/anticipated remediation actions can be tracked and verified. Flaw remediation actions that can be tracked and verified include, for example, determining whether organizations follow US-CERT guidance and Information Assurance Vulnerability Alerts.
To set the Vulnerability version to version 4, run the following command:

ibmcloud cr va-version-set v4







 ibmcloud cr vulnerability-assessment (ibmcloud cr va) 

View a vulnerability assessment report for your images.

ibmcloud cr vulnerability-assessment [--extended | -e] [--vulnerabilities | -v] [--configuration-issues | -c] [--output FORMAT | -o FORMAT] IMAGE [IMAGE...]

From version 1.0.0 of the container-registry plug-in, you can choose whether to run the ibmcloud cr vulnerability-assessment command in either version 3 (the default) or version 4 of Vulnerability Advisor. If you want to run Vulnerability Advisor in a different version, see [Setting the Vulnerability Advisor version](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_set_version). For more information about the versions of Vulnerability Advisor, see [About Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiabout).



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).





 Command options 

IMAGE
: The name of the image for which you want to get a report. The report states whether the image has any known package vulnerabilities. You can request reports for multiple images at the same time by listing each image in the command with a space between each name.

To find the names of your images, run ibmcloud cr image-list. Combine the content of the Repository column (repository) and Tag column (tag) separated by a colon (:) to create the image name in the format repository:tag. If a tag is not specified in the image name, the report assesses the image that is tagged latest.
You can create image security policies for each Kubernetes namespace, or at the cluster level, and enforce different rules for different images.

Fixing the security and configuration issues that are reported by Vulnerability Advisor can help you to secure your IBM Cloud infrastructure.

See the following for more information on Container Registry and how to set it up:



* [About Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview)
* [Setting up Container Registry as a private registry on Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_rhos)
* [Managing image security with Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=va-va_index)
* [Signing images for trusted content](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontent)
* [Container Registry and Vulnerability Advisor workflow tutorial](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_tutorial_workflow)







 Virtual server instances 

There is not a Financial Services Validated solution for scanning virtual server images. You need to install your own software solution.





 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 System and Information Integrity (SI) [SI-7 Software & Information Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-7)
When Vulnerability Advisor version 3 reaches its end of support date, any Container Registry CLI commands that access Vulnerability Advisor version 3 cease to work. An end of support date is not available yet.

If you use the Vulnerability Advisor REST API to access Vulnerability Advisor, you must update your client call from /va/api/v3 APIs to /va/api/v4 APIs.

If you use one of the Vulnerability Advisor version 3 SDKs to access Vulnerability Advisor, you must update to the Vulnerability Advisor version 4 SDK.

Any exemptions that you previously defined continue to work. However, the security notice value that comes back in Vulnerability Advisor version 4 might not be the same as for Vulnerability Advisor version 3 because different sources of data are used. Therefore, if the returned value isn't the same as for Vulnerability Advisor version 3, you might have to update any existing exemptions that specify a security notice. Red Hat® security notices are unaffected. Exemptions that are defined by CVE value are also unaffected.

Differences in Vulnerability Advisor version 4 behavior are documented in [About Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiabout).





 What actions you must take by 19 June 2023 

You can choose whether to update to use version 4, the default, or to continue to use version 3, which is deprecated.



* If you want to use Vulnerability Advisor version 4 as the default, update the following items as described in [What you need to know about this change](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4notices_va_v4_change):



* The Container Registry CLI plug-in and, if you have explicitly run the ibmcloud cr va-version-set v3 command previously, run the following command.

ibmcloud cr va-version-set v4
* Any code that calls Vulnerability Advisor version 3 either through the API or through the SDK.
* You might have to update any existing exemptions that specify a security notice.



* If you want to continue to use Vulnerability Advisor version 3, run the following command:

ibmcloud cr va-version-set v3
From version 1.0.0 of the container-registry plug-in, you can choose whether to run the ibmcloud cr vulnerability-assessment command in either version 3 (the default) or version 4 of Vulnerability Advisor. If you want to run Vulnerability Advisor in a different version, see [Setting the Vulnerability Advisor version](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_set_version). For more information about the versions of Vulnerability Advisor, see [About Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiabout).

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

If the command to list images times out, see [Why is it timing out when I list images?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-image-timeout) for assistance.

ibmcloud cr image-list [--format FORMAT] [--quiet | -q ] [--restrict RESTRICTION] [--include-ibm] [--no-trunc] [--show-type] [--no-va] [--va]



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).





 Command options 

--format FORMAT
: (Optional) Format the output elements by using a Go template. For more information, see [Formatting and filtering the Container Registry CLI output](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_cli_list).

--quiet, -q
: (Optional) Each image is listed in the format: repository:tag

--restrict RESTRICTION
* A prioritized view of cyberrisk and compliance risks across hybrid cloud with Detect, Predict, Act dashboard views.
* The ability for a user to visually interact with data to quickly identify assets at risk, based on risk priorities.
* Easy-to-use graphs, metrics, and filters to develop insight into the identified risks.
* Interactive drill downs for greater depth of information on application data flows, vulnerabilities or configuration issues across locations, organizations, applications, and assets.
* Allow the user to develop complete knowledge of the operational stack that includes, infrastructure, platform, application, and data.
* The ability to visualize and enforce policies for segmentation of networks, VMs, or applications across the hybrid cloud.





 Zones 

Caveonix RiskForesight has the concept of zones.

Zoom

![Zones diagram](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/caveonix-zones.svg)

Figure 2. Caveonix RiskForesight zones



* Management or Service Provider Zone - The management or service provider zone includes the following components:



* RiskForesight Application - Contains multiple components and is described in detail in the Application Components section.
* Central Collector – Collects information from the cloud providers and tenant zones.



* Cloud Providers - This zone provides the infrastructure on which applications are hosted:



* Private – VMware on IBM Cloud®, and on-premises, VMware infrastructure platforms. These platforms are integrated into RiskForesight through: vCenter, NSX Manager, VMware Cloud Director (vCD), or VMware Aria® Automation™.
* Public – Currently the only public cloud provider that is supported is AWS. IBM Cloud is available soon.
* Containers - Currently only AWS Elastic Kubernetes Service (EKS) is supported. IBM Cloud Private and IBM Cloud Kubernetes Services coming later.



* Tenant or Customer Environment Zone – Used to separate tenants, customer, or business units. A remote collector is required because workloads exist in these zones.
SA-3 (d) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether Container Registry image pushes and pulls take place only over private endpoints<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts<br> * Check whether DevSecOps Toolchain signs build artifacts to attest their provenance<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br> 







 NIST supplemental guidance 

A well-defined system development life cycle provides the foundation for the successful development, implementation, and operation of organizational information systems. To apply the required security controls within the system development life cycle requires a basic understanding of information security, threats, vulnerabilities, adverse impacts, and risk to critical missions/business functions. The security engineering principles in SA-8 cannot be properly applied if individuals that design, code, and test information systems and system components (including information technology products) do not understand security. Therefore, organizations include qualified personnel, for example, chief information security officers, security architects, security engineers, and information system security officers in system development life cycle activities to ensure that security requirements are incorporated into organizational information systems. It is equally important that developers include individuals on the development team that possess the requisite security expertise and skills to ensure that needed security capabilities are effectively integrated into the information system.
To set up a host-based intrusion detection system (HIDS) and security event log monitoring (SELM), install third-party tools that are designed to monitor your cluster and containerized apps to detect intrusion or misuse, such as [Twistlock](https://www.paloaltonetworks.com/prisma/cloud) or the [Sysdig Falco project](https://sysdig.com/opensource/falco/).

How can I audit events that happen in my cluster?
: You can [set up IBM Cloud® Activity Tracker in your Red Hat OpenShift on IBM Cloud cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-at_eventsat_events). For more information, view the [Activity Tracker documentation](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

What are my options to enable trust in my cluster?
: By default, Red Hat OpenShift on IBM Cloud provides many features for your cluster components so that you can deploy your containerized apps in a security-rich environment. Extend your level of trust in your cluster to better ensure that what happens within your cluster is what you intended to happen. You can implement trust in your cluster in various ways, as shown in the following diagram.

Zoom

![Deploying containers with trusted content.](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/trusted_story.svg)

Figure 1. Deploying containers with trusted content



1. Content Trust for your images: Ensure the integrity of your images by enabling content trust in your IBM Cloud Container Registry. With trusted content, you can control who can sign images as trusted. After trusted signers push an image to your registry, users can pull the signed content so that they can verify the source of the image.
Red Hat® Enterprise Linux® (RHEL) RHEL/UBI 7, RHEL/UBI 8, and RHEL/UBI 9 [Red Hat Security Data API](https://access.redhat.com/labsinfo/securitydataapi). 
 Ubuntu All stable versions with vendor security support. [Ubuntu CVE Tracker](https://launchpad.net/ubuntu-cve-tracker). 







 Configuration issues - version 3 only 

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

Configuration issues are potential security issues that are related to how an

appis set up. Configuration issues are not supported in version 4.

Many of the reported problems can be fixed by updating your

Dockerfile.

Images are scanned only if they are using an operating system that is supported by Vulnerability Advisor. Vulnerability Advisor checks the configuration settings for the following types of apps:



* MySQL
* NGINX
* Apache









 Setting the Vulnerability Advisor version 

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

Starting from version 1.0.0 of the Container Registry plug-in, you can choose whether to fetch results from either version 3, v3 (the default), or version 4, v4, of Vulnerability Advisor for the following commands:



* [ibmcloud cr va IMAGE](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_va), where IMAGE is the name of the image.
report for more details by using the ibmcloud cr va command.

The Vulnerability Advisor verdict is subject to any [exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_managing_policy) that you create. If you want to use an image that Vulnerability Advisor considers vulnerable, you can exempt one, or more vulnerabilities so that Vulnerability Advisor doesn't consider them in its verdict. You can see whether an issue is exempted by looking at the Policy Status column in the output of the ibmcloud cr va command, and you can also list your exemptions by running the [ibmcloud cr exemption-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_list) command.







 Resolve vulnerabilities in your image 

Vulnerability Advisor provides steps to resolve each vulnerability that is present in an image. The steps are displayed in the How To Resolve column in the output of the ibmcloud cr va command. If you follow the steps, you can resolve the issues in your image.

Because CVEs are frequently discovered and patched, this Dockerfile includes a contrived vulnerability that is introduced by rolling a package back to a known vulnerable version. Therefore, to fix the vulnerability, you can comment out the line that rolls back apt.



1. To prevent apt from being rolled back, comment out the following line in Dockerfile-vulnerable by putting a number sign () at the beginning of the line as shown here:

 RUN apt-get install --allow-downgrades -y apt=1.4.8
2. Build and push the image again:



1. Build the image again by running the following command:

docker build -t us.icr.io/<my_namespace>/hello-world:2 -f Dockerfile-vulnerable .
2. Push the image again by running the following command:

docker push us.icr.io/<my_namespace>/hello-world:2



3.
"pipeline_id": "b1cfb6a4-813d-4fec-bbf7-ce662e8ce4e0", // the id of the pipeline that generated this piece of evidence
"pipeline_run_id": 12345, // this is the id of the pipeline run that generated this piece of evidence
"last_scan_date": "24-03-2020 UTC", // the last time the scan was run
"result": "passed"|"failed"], // the result of the scan
"log": {
"url": "https://acme.org/log.txt", // the link to where the actual log of the test is
"hash": "abc123", // the hash of the log file
},
"expired_issues": 134,132,342], // link(s) to the issues for which the grace period expired
"issues": 234,343,342], // link(s) to the issue(s) created to track the bugs found during the test run. Should be populated only if the scan failed
"required": "yes" | "no" ] // yes: this is an auditable step; no: this is a non auditable step
}, {
// Partial: RA-5(a) Scans for vulnerabilities in the information system and hosted applications Assignment: organization-defined
// frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting
// the system/applications are identified and reported;
// Partial: RA-5(b). Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts
// of the vulnerability management process by using standards for:..
// SA-11(1) DEVELOPER SECURITY TESTING AND EVALUATION | STATIC CODE ANALYSIS
// The organization requires the developer of the information system, system component, or information system service to employ static code
// analysis tools to identify common flaws and document the results of the analysis.
// Control passed if:
Accelerated development is a key win for the IT Exec. With the move to public cloud, Developers can experiment easily with Node.js SDK, pushing changes to Development and Test systems, scaled out on separate clusters. Those pushes were automated with open toolchains and IBM Cloud® Continuous Delivery. Updates to the SaaS system no longer languished in slow, error-prone build processes. The Developers can deliver incremental updates to their users, daily or even more frequently. Also, logging and monitoring for the SaaS systems, especially how the patient front-end and back-end reports interact, rapidly integrate into the system. Developers don’t waste time building complex logging systems, just to be able to troubleshoot live systems.

Security first: With bare metal for Red Hat OpenShift on IBM Cloud, the sensitive patient workloads now have familiar isolation but within the flexibility of public cloud. From that core, Vulnerability Advisor provides scanning:



* Image vulnerability scanning
* Policy scanning based on ISO 27k



Secure patient data leads to happier patients.



 Context 



* Technical debt, which is coupled with long release cycles, is hindering the provider’s business-critical patient management and reporting systems.
* Their back-office and front-office custom apps are delivered on-premises in monolithic virtual machine images.
* They need to overhaul their processes, methods, and tools but don’t know quite where to start.
* Their technical debt is growing, not shrinking, from an inability to release quality software to keep up with market demands.
* Security is a primary concern, and this issue is adding to the delivery burden, which causes even more delays.
* Capital expense budgets are under tight control, and IT feels they don't have the budget or staff to create the needed testing and staging landscapes with their in-house systems.







 Solution 

Compute, storage, and I/O services run in the public cloud with secure access to on-premises enterprise assets. Implement a CI/CD process and other parts of the IBM Garage Method to dramatically shorten delivery cycles.



 Step 1: Secure the compute platform 



* From that core, Vulnerability Advisor provides image, policy, container, and packaging scanning vulnerability scanning.