vania-janet/multiturn-rag-retrieval-data huggingface dataset:
HAProxy 508bf6 8d6ea6 [CVE-2022-42010](https://nvd.nist.gov/vuln/detail/CVE-2022-42010), [CVE-2022-42011](https://nvd.nist.gov/vuln/detail/CVE-2022-42011), [CVE-2022-42012](https://nvd.nist.gov/vuln/detail/CVE-2022-42012), [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303), [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304), [CVE-2022-3821](https://nvd.nist.gov/vuln/detail/CVE-2022-3821), [CVE-2022-35737](https://nvd.nist.gov/vuln/detail/CVE-2022-35737), [CVE-2022-43680](https://nvd.nist.gov/vuln/detail/CVE-2022-43680), [CVE-2021-46848](https://nvd.nist.gov/vuln/detail/CVE-2021-46848). 







 Change log for worker node fix pack 1.25.5_1528, released 16 January 2023 

The following table shows the changes that are in the worker node fix pack 1.25.5_1528. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.25.5_1527

 Component Previous Current Description
https://nvd.nist.gov/vuln/detail/CVE-2018-18520), [CVE-2018-18521](https://nvd.nist.gov/vuln/detail/CVE-2018-18521), [CVE-2019-7149](https://nvd.nist.gov/vuln/detail/CVE-2019-7149), [CVE-2019-7150](https://nvd.nist.gov/vuln/detail/CVE-2019-7150), [CVE-2019-7664](https://nvd.nist.gov/vuln/detail/CVE-2019-7664), [CVE-2019-7665](https://nvd.nist.gov/vuln/detail/CVE-2019-7665), [CVE-2016-10739](https://nvd.nist.gov/vuln/detail/CVE-2016-10739), [CVE-2018-16871](https://nvd.nist.gov/vuln/detail/CVE-2018-16871), [CVE-2018-16884](https://nvd.nist.gov/vuln/detail/CVE-2018-16884), [CVE-2019-11085](https://nvd.nist.gov/vuln/detail/CVE-2019-11085), [CVE-2019-11811](https://nvd.nist.gov/vuln/detail/CVE-2019-11811), [CVE-2018-
However, it is recommended that separate host instances are provisioned for the Data Security Broker Manager and Data Security Broker Shield, to accommodate different workloads.

Which OS is necessary to set up the Data Security Broker Shield?

Data Security Broker Shield can be installed on instances running with Ubuntu 18 for IBM Cloud Kubernetes cluster (IKS) or RedHat Enterprise Linux (RHEL) 7 for IBM Red Hat OpenShift Kubernetes cluster (ROKS).

Why does an invalid certificate browser warning occasionally show up?

Most web browsers will flag this connection as unsafe if Data Security Broker Manager is not initialized with an HTTPS certificate. To avoid the warning, configure HTTPS in the settings page in Data Security Broker Manager.

Where are the secrets submitted to Data Security Broker kept?

A secure credential store is created in MongoDB by Data Security Broker Manager. This is encrypted with a key that is configured during set up.

Why is the Deploy Policy and Migrate Data option disabled in the Data Security Broker Manager UI?

The application in which you are trying to perform the encryption or decryption does not have a Data Security Broker Shield attached to it. Associate a Data Security Broker Shield to the application before performing the encryption or decryption process.

Where do I get the information to connect the application to Data Security Broker Shield?

If you have self-registered Shields, they are added using the Shield Sync ID, after the application is set up. The Shield Sync ID is found in the Application side panel.

Are there any analytics reports?

For this service, analytics reports are not applicable.

How do I debug if there are any problems?

Refer to the [Logging and Debugging in Data Security Broker section](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_logging).

How do I add multiple Data Security Broker Shields?

Yes, you can install multiple instances of the Data Security Broker Shields using the IBM Cloud Catalog. Ensure that you have specified different Shield names during the installation for each Shield.

How is the load balanced between Shield instances?

Load balancing between Shield instances is managed by OpenShift load balancing policies.
SC-5 - Denial of Service Protection 



  Control requirements 

SC-5 - 0
:   The information system protects against or limits the effects of the following types of denial of service attacks: [IBM Assignment: application and volumetric based attacks (OSI layers 3, 4, 6, and 7)] by employing [IBM Assignment: annual testing of the documented DoS and DDoS mitigation technologies].





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Accessing the public internet](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-to-internet)
*  [Connectivity to IBM Cloud services with private endpoints](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-to-ibm-services)
*  [Consumer connectivity to workload VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-workload)
*  [Creating and connecting the management and workload VPCs](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-create-vpcs)







  NIST supplemental guidance 

A variety of technologies exist to limit, or in some cases, eliminate the effects of denial of service attacks. For example, boundary protection devices can filter certain types of packets to protect information system components on internal organizational networks from being directly affected by denial of service attacks. Employing increased capacity and bandwidth combined with service redundancy may also reduce the susceptibility to denial of service attacks.
HAProxy 508bf6 8d6ea6 [CVE-2022-42010](https://nvd.nist.gov/vuln/detail/CVE-2022-42010), [CVE-2022-42011](https://nvd.nist.gov/vuln/detail/CVE-2022-42011), [CVE-2022-42012](https://nvd.nist.gov/vuln/detail/CVE-2022-42012), [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303), [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304), [CVE-2022-3821](https://nvd.nist.gov/vuln/detail/CVE-2022-3821), [CVE-2022-35737](https://nvd.nist.gov/vuln/detail/CVE-2022-35737), [CVE-2022-43680](https://nvd.nist.gov/vuln/detail/CVE-2022-43680), [CVE-2021-46848](https://nvd.nist.gov/vuln/detail/CVE-2021-46848). 







 Change log for worker node fix pack 1.24.9_1550, released 16 January 2023 

The following table shows the changes that are in the worker node fix pack 1.24.9_1550. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.24.9_1549

 Component Previous Current Description
The distinguishing feature is the ability to configure a trusted profile, so that specific identities or resources can act under its identity. These identities and resources might be even located in other accounts. Thus, on a high level, the use case for using trusted profiles is to allow administrative work



* with a given set of privileges
* under a specific identity
* for identities or resources identified by a set of properties configured as part of the trusted profile.



The following scenarios are such use cases for trusted profiles, differing by the way the trust is established:



* Map federated users and their group membership to IBM Cloud privileges: Configure a trusted profile to let users of a federated identity provider assume its identity. You can define which IdP and what user attributes to consider.
* Perform administrative tasks from dedicated compute resources: You can configure a trusted profile to establish trust through a well-known compute resource. Such a resource might be a specific pod in a Kubernetes cluster (including Red Hat OpenShift on IBM Cloud) or a virtual server instance (VSI) in a virtual private cloud (IBM Cloud VPC).
* Perform administrative tasks from a well-known service ID: A service ID from the same or another account is allowed to assume the identity of the trusted profile.
* Deploy cloud resources from an instance of a special cloud service: Configure an instance of an IBM Cloud service, identified by its CRN ([cloud resource name](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx9494304)) to be allowed to assume the identity of a trusted profile. A typical scenario is for an [enterprise project to deploy an architecture](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-tp-project).







 Establish trust 

As outlined in the overview, there are different options available on how to establish trust, how an entity can assume the identity of a trusted profile.



 Federated identity 

[Users that utilize a corporate or enterprise single sign-on ID to log in to IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-federated_id) are called federated identities.
More details are available in the [security bulletin](https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerabilities-in-openssl-affect-ibm-sdk-for-node-js-in-ibm-bluemix-cve-2015-0286-cve-2015-0287-cve-2015-0288-cve-2015-0289-cve-2015-0292-cve-2015-0293-cv/).
* Fixed vulnerability in RC4 Stream Cipher affecting IBM SDK for Node.js. More details are available in the [security bulletin](https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerability-in-rc4-stream-cipher-affects-ibm-sdk-for-node-js-in-ibm-bluemix-cve-2015-2808/).









 15 April 2015 

Updated Liberty buildpack v1.16-20150407-1737
: This version of the buildpack contains an updated IBM JRE 7.1-2.11 with a [security fix for the Bar Mitzvah vulnerability](https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerability-in-rc4-stream-cipher-affects-liberty-for-java-for-ibm-bluemix-cve-2015-2808/).



* When stand-alone WAR files are deployed, if provided, the buildpack now uses the context-root that is specified in the embedded ibm-web-ext.xml file as the app's context root. With this change, apps that were previously deployed under the root context might be deployed under a different context based on the settings in the ibm-web-ext.xml file.







 3 April 2015 

Updated Liberty buildpack v1.15-20150402-1422
: The buildpack contains an updated version of the Liberty profile based on the [March beta](https://developer.ibm.com/wasdev/blog/2015/03/13/announcing-liberty-beta-tools-march-2015/).
NSX also provides North-South connectivity inbound and outbound of IBM Cloud data centers, thus enabling tenants to access public networks securely and efficiently.





 Logical firewall 

Logical firewall provides security mechanisms for dynamic virtual data centers. The Distributed Firewall component of an NSX Logical Firewall allows users to segment virtual data center entities (virtual servers), vCenter objects (data centers and hosts), and traditional networking attributes like IP addresses and VLANs. The Edge Firewall component helps you achieve key perimeter security needs such as building DMZs that are based on IP/VLAN constructs, tenant to tenant isolation in multi-tenant virtual data centers, Network Address Translation (NAT), VPNs, and user-based SSL VPNs. Edge Firewalls can be used in combination with or in place of Vyatta & Fortinet services from IBM Cloud for perimeter protection. The Firewall Flow Monitoring feature displays network activity between virtual machines at the application protocol level. You can use this information to audit network traffic, define and refine firewall policies, and identify threats to your network.





 Logical Virtual Private Networks (VPN)s 

SSL VPN-Plus allows remote users to access private corporate applications. IPSec VPN offers site-to-site connectivity between an NSX Edge instance and remote sites (VMware running on IBM Cloud). L2 VPNs allow users to extend your data center by allowing virtual machines to retain network connectivity across geographical boundaries and across IBM Cloud data centers and your local VMware environment.





 Logical load balancer 

The NSX Edge load balancer enables network traffic to follow multiple paths to a specific destination. It distributes incoming service requests evenly among multiple servers in such a way that the load distribution is transparent to users. Load balancing thus helps in achieving optimal resource utilization, maximizing throughput, minimizing response time, and avoiding overload. NSX Edge provides load balancing up to Layer 7.





 Service composer 

Service composer helps you provision and assign network and security services to applications in a virtual infrastructure. These services can be mapped and applied to virtual machines in the security groups. Data security provides visibility into sensitive data that is stored within your organization's virtualized and cloud environments that include IBM Cloud.
HAPROXY 508bf6 8d6ea6 [CVE-2022-42010](https://nvd.nist.gov/vuln/detail/CVE-2022-42010), [CVE-2022-42011](https://nvd.nist.gov/vuln/detail/CVE-2022-42011), [CVE-2022-42012](https://nvd.nist.gov/vuln/detail/CVE-2022-42012), [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303), [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304), [CVE-2022-3821](https://nvd.nist.gov/vuln/detail/CVE-2022-3821), [CVE-2022-35737](https://nvd.nist.gov/vuln/detail/CVE-2022-35737), [CVE-2022-43680](https://nvd.nist.gov/vuln/detail/CVE-2022-43680), [CVE-2021-46848](https://nvd.nist.gov/vuln/detail/CVE-2021-46848). 







 Change log for worker node fix pack 1.23.15_1558, released 16 January 2023 

The following table shows the changes that are in the worker node fix pack 1.23.15_1558. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.23.15_1557

 Component Previous Current Description
Key Protect now uses IBM Cloud Hardware Security Module 7.0 for cryptographic storage and operations
: Your Key Protect keys are stored in FIPS 140-2 Level 3-compliant, tamper-evident hardware for all regions. To learn more about the features and benefits of IBM Cloud HSM 7.0, check out the [product page](https://cloud.ibm.com/cloud/hardware-security-module).





 15 May 2019 

The legacy Key Protect service, based on Cloud Foundry, reached its end of support on 15 May 2019. : Cloud Foundry-managed Key Protect instances are no longer supported and updates to the legacy service will no longer be provided. Customers are encouraged to use Key Protect instances that are IAM-managed to benefit from the latest features for the service. If you created your Key Protect instance after 15 December 2017, your instance is IAM-managed and it is not affected by this change.



* Need to remove a Key Protect service instance from the Cloud Foundry Services section of your IBM Cloud resource list? You can reach out to us in the [Support Center](https://cloud.ibm.com/unifiedsupport/cases/add) by submitting a request to remove the entry from your console view.









 March 2019 



 22 March 2019 

Announcing rotation policies for root keys
: You can now use Key Protect to associate a rotation policy for your root keys. For more information, see [Setting a rotation policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy). To find out more about your key rotation options in Key Protect, check out [Comparing your key rotation options](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-rotationcompare-key-rotation-options).





 20 March 2019 

Announcing secure import of encryption keys
: Enable the secure import of encryption keys to the cloud by creating transport encryption keys for your Key Protect service. For more information, see [Bringing your encryption keys to the cloud](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keys).







 February 2019 



 13 February 2019
Save Policy: 

Save Policy option is selected by default. This option saves your selected data, but does not execute encryption or data protection on your database. Your policy remains saved with the application until a new policy is saved to overwrite it. You can use the saved policy to deploy or migrate it later.





 Deploy Policy: 

Deploy Policy option saves your policy and deploys your configured Data Security Broker Shield as a proxy for the configured database. You can connect to your Data Security Broker Shield endpoint, as if it was your database endpoint, to access your database. Any data that passes through your Data Security Broker Shield proxy is encrypted in the database, if that data is defined in your policy.





 Deploy Policy and Migrate Data: 

Deploy Policy & Migrate Data option saves your policy, deploys it, and migrates your existing selected tables and columns through the specified Data Security Broker Shield to encrypt the data. Data Security Broker Shield acts as a proxy for the configured database, and the data is encrypted as well.

This option is disabled for applications, which does not have a Data Security Broker Shield associated with it.







 Key Benefits of Data Security Broker: 



* Secure database content throughout the encryption process.
* Protect the data with column-level granularity.
* Easy key management.
* Leverage cloud infrastructure without compromising security.
(https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_single_multitenant.png)

Figure 1. Single tenant versus multi-tenant cluster

Deciding between single-tenant and multi-tenant clusters depends on the number of teams that must run workloads in a cluster, their service requirements, the size of the service, and the level of isolation that you want to achieve for your workloads.

A single-tenant cluster might be your option if you have many teams with complex services that each must have control over the lifecycle of the cluster. This includes having the freedom to decide when a cluster is updated or what resources can be deployed to the cluster. You can also configure a single-tenant cluster to allow privileged pods without putting other tenants at risk of being compromised. Keep in mind that managing a cluster requires in-depth Kubernetes and infrastructure knowledge to ensure cluster capacity and security for your deployments.

Multi-tenant clusters use Kubernetes namespaces to isolate tenants and are usually managed by a separate team that does not belong to one of the tenants. A multi-tenant cluster might be your option if you have multiple teams that must run small workloads in a cluster, and where creating a single-tenant cluster that is highly available across multiple zones does not bring the cost benefits that you want. While multi-tenant clusters usually require fewer people to manage and administer the cluster, they might not provide the level of isolation that you need and add more complexity in the following areas:



* Access: When you set up multiple namespaces, you must configure proper RBAC policies for each namespace to ensure resource isolation. RBAC policies are complex and require in-depth Kubernetes knowledge.
* Privileged pods: If one tenant in a multi-tenant cluster requires to run privileged pods, this pod can access other namespaces in the cluster or damage the shared compute host. Controlling privileged pods is a complex task that requires effort and deep technical expertise.
* Data Key Protection Since your DEKs are wrapped by a root key, you do not have to worry about how to store the encrypted data key. Due to this, you can store the wDEK with alongside the associated encrypted data.



Key Protect uses the Advanced Encryption Standard algorithm in Galois/Counter Mode (AES GCM) to wrap and unwrap DEKs. CRKs that are not imported are created with 256-bit key material. Imported CRKs can be have 128, 192, or 256-bit key material.



 How envelope encryption works 

Envelope encryption works by using a root key to wrap (encrypt) one or more data encryption keys (DEKs). The root key safeguards your wrapped (encrypted) DEKs with encryption algorithms, protecting them from unauthorized access or exposure.

Unwrapping a DEK reverses the envelope encryption process by using the associated root key, resulting in a decrypted and authenticated DEK. A wrapped DEK cannot be unwrapped without the associated root key, which adds an extra layer of security to your data.

Envelope encryption is treated briefly in the NIST Special Publication 800-57, Recommendation for Key Management. To learn more, see [NIST SP 800-57 Pt. 1 Rev. 4.](https://www.nist.gov/publications/recommendation-key-management-part-1-general-0).





 Key types 

The service supports two key types, root keys and standard keys, for the advanced encryption and management of data.

Root keys
: Root keys are primary resources in Key Protect. They are symmetric key-wrapping keys used as roots of trust for wrapping (encrypting) and unwrapping (decrypting) other keys stored in a data service. Root keys contain key material that is used to wrap and unwrap DEKs. The key material of the root key can either be imported or generated by the Key Protect service.
: With Key Protect, you can create, store, and manage the lifecycle of root keys to achieve full control of other DEKs stored in the cloud.
For more information about creating and invoking Functions, see [Working with Functions in Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-fun-work).





 Security 

Code Engine provides out-of-the-box DDOS protection for your Function. Code Engine's DDOS protection is provided by Cloud Internet Services (CIS) at no additional cost to you. DDoS protection covers System Interconnection (OSI) Layer 3 and Layer 4 (TCP/IP) protocol attacks, but not Layer 7 (HTTP) attacks. See [DDoS protection](https://cloud.ibm.com/docs/codeengine?topic=codeengine-securesecure-ddos).

Code Engine also provides a service mesh to use its networking layer, which enables mutual Transport Layer Security (TLS) traffic for Functions, thus securing service-to-service and user-to-service communication.

For more information about security, see [Code Engine and security](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secure).





 Invocation concurrency and scaling of Function instances 

When multiple Functions are being invoked at the same time, Code Engine initializes new Function instances for each invocation, but at the same time, tries to maximize the reuse. Only one Function invocation is handled by a Function instance at a single point in time. For Node.js, the Function can be configured with concurrency > 0 to allow multiple invocations to be handled in a single Function instance.





 Packaging your source code for a Function 

Functions can be packaged in three different ways.



* as a single file
* as multiple files (with a folder structure and dependent modules)
* as a container image









 How can I get started with Functions? 

To deploy a simple Code Engine application with a hello-world sample image, see [Running IBM Code Engine Functions](https://cloud.ibm.com/docs/codeengine?topic=codeengine-fun-tutorial) tutorial.