vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The VMware Security Hardening Guides provide the technology-specific controls that are required for you to complete this review. Caveonix RiskForesight automates this compliance task and provides additional regulatory agency guidance.

VMware Aria® Operations™ Manager provides monitoring of VMware objects for violations against the compliance rules in the vSphere Security Configuration Guide. The compliance alerts trigger on the vCenter Server instance, hosts, virtual machines, distributed port groups, or distributed switches, allowing the investigation of the compliance violation. For Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry Data Security Standard (PCI DSS) compliance, you can download VMware Aria Operations Manager Compliance Packs from the VMware Solutions Exchange website, licensed, and installed. These Compliance Packs provide Alerts, policies, and Reports to validate the vSphere resources against the HIPAA and PCI hardening guides.



 Related links 



* [FortiGate Security Appliance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fsa_considerations)
* [FortiGate Virtual Appliance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortinetvm_considerations)
* [F5 BIG-IP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations)
* [Entrust CloudControl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-cc_considerations)
* [Entrust DataControl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-dc_considerations)
* [Entrust KeyControl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-kc_considerations)
Before you can use the ED algorithm, make sure to enable this feature by following the instructions in [Enabling Edwards-curve Digital Signature Algorithm](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-mechanismsenable-EdDSA).

Added: Using Terraform to manage Hyper Protect Crypto Services instances and resources
: Terraform is an open source software to configure and automate cloud resource provisioning and management. Now you can provision and initialize Hyper Protect Crypto Services instances, as well as managing root keys and standard keys with the Terraform CLI and the IBM Cloud Provider plug-in. For more information, see [Managing key management service resources with Terraform](https://cloud.ibm.com/docs/terraform?topic=terraform-kms-resources), [Retrieving key management service data with Terraform](https://cloud.ibm.com/docs/terraform?topic=terraform-kms-data-sources), and the [sample Terraform template for Hyper Protect Crypto Services](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-hpcs-crypto).

Updated: key management service API
: The Hyper Protect Crypto Services key management service API is updated with the following changes:



* Updated: The API methods for the following key actions are now transferred to individual request paths. The generic path format (except the action of restoring a key) is /api/v2/keys/<key_ID>/actions/<action> where key_ID is the UUID of the key and action is the action name that you want to execute.



* [Wrap a key](https://cloud.ibm.com/apidocs/hs-cryptowrapkey).
* [Unwrap a key](https://cloud.ibm.com/apidocs/hs-cryptounwrapkey).
* [Rewrap a key](https://cloud.ibm.com/apidocs/hs-cryptorewrapkey).
You can request reports for multiple images at the same time by listing each image in the command with a space between each name.

To find the names of your images, run ibmcloud cr image-list. Combine the content of the Repository column (repository) and Tag column (tag) separated by a colon (:) to create the image name in the format repository:tag. If a tag is not specified in the image name, the report assesses the image that is tagged latest.

For information about supported Docker base images, see [Vulnerable packages](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uipackages).

For more information, see [Managing image security with Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=ui).

--extended, -e
: (Optional) The command output shows additional information about fixes for vulnerable packages.

--vulnerabilities, -v
: (Optional) The command output is restricted to show vulnerabilities only.

--configuration-issues, -c
: (Optional) The command output is restricted to show configuration issues only.

--output FORMAT, -o FORMAT
: (Optional) The command output is returned in the chosen format. The default format is text.

The following formats are supported:



* text
* json







 Examples 

View a standard vulnerability assessment report for your image.

ibmcloud cr vulnerability-assessment us.icr.io/birds/bluebird:1

View a vulnerability assessment report for your image us.icr.io/birds/bluebird:1 in JSON format, showing vulnerabilities only.

ibmcloud cr vulnerability-assessment --vulnerabilities --output json us.icr.io/birds/bluebird:1
* Image tags: 1.19.1-101-2, 1.20.0-101-2, 1.21.0-101-2, 1.22.0-101-2, 1.23.0-101-2
* Resolves [CVE-2022-29526](https://nvd.nist.gov/vuln/detail/CVE-2022-29526).







 Change log for patch update 1.1.0_682, released 30 June 2022 



* Image tags: 1.19.1 110-1, 1.20.0 110-1, 1.21.0 110-1, 1.22.0 110-1, 1.23.0 110-1
* Adds storage-secret-store compatibility fixes for Satellite clusters.
* Adds logging improvements.







 Change log for patch update 1.1.0_615, released 16 May 2022 



* Image tags: 1.19.1-110-0, 1.20.0-110-0, 1.21.0-110-0, 1.22.0-110-0, 1.23.0-110-0
* Resolves [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327), [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675), and [CVE-2022-27536](https://nvd.nist.gov/vuln/detail/CVE-2022-27536).
* Ignores label ibm-cloud.kubernetes.io/vpc-instance-id for zone balancing in satellite environments.
* Adds experimental option balancingIgnoreLabelsFlag. This option defines a node label that should be ignored when considering node group similarity. One label can be defined per option occurrence.







 Change log for patch update 1.1.0_475, released 30 March 2022
The following sample code snippets show how you can use the netpol-analyze command:

ibmcloud cra netpol-analyze --path PATH --report REPORT [--connectivity CONNFILE] [--lint LINTFILE] [--strict]

ibmcloud cra np --path ./sampleDir --report netpol-report.json --strict





 Network config analyzer image 

The netpol-analyze command runs as part of IBM's [Network Config Analyzer (NCA)](https://github.com/IBM/network-config-analyzer). Because this command runs NCA as a Docker image, you must install [Docker](https://www.docker.com/) on your computer.

The image URL for the network policy analyzer is icr.io/continuous-delivery/cra/nca.

If the analyzer image is not already in your local registry, the netpol-analyze command pulls the latest analyzer image (including fixes for any vulnerabilities) from the global IBM Cloud® Container Registry.







 Using Code Risk Analyzer in Tekton pipelines 

You can use the [task-cra](https://github.com/open-toolchain/tekton-catalog/tree/master/cracra) task in Tekton pipelines. Use the [Tekton pipeline definition](https://github.com/open-toolchain/tekton-catalog/tree/master/cra/sample-v2) when you create a pull request, a manual trigger, or issue a commit. You can also create your own Tekton tasks and run the Code Risk Analyzer from those tasks.





 Using Code Risk Analyzer in DevSecOps 

You can use Code Risk Analyzer in [DevSecOps](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops_intro). The following table lists and describes the supported Code Risk Analyzer parameters for DevSecOps.
IBM Secrets Manager securely stores and applies secrets such as API keys, Image Signature, or HashiCorp credentials that are part of your toolchain.

Zoom

![Secrets Manager options](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/ds-vpc-setup-secrets-manager.png)

Figure 6. Secrets Manager options

For more information about managing your secrets in IBM Key Protect or HashiCorp, see [IBM Key Protect](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-tekton-ci-compliancecd-devsecops-key-protect-ci) or [HashiCorp](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-tekton-ci-compliancecd-devsecops-vault-ci).







 Step 2: Configure the deployment target 

Configure the deployment target for the toolchain by specifying details for the VPC, Bastion Host, Load Balancer, and Artifact Store. This tutorial uses the Blue-Green deployment strategy.

Zoom

![Deployment target Blue-Green strategy](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/ds-vpc-setup-dep-target-bg.png)

Figure 7. Deployment target Blue-Green strategy



 Configure VPC details 

Configure the toolchain by specifying information about the VPC and Virtual Server Instances (VSI).

You provisioned the VPC and VSI by using IBM Cloud® Schematics and Terraform when you selected the deployment strategy to use.
Version 1.0.0 of the CLI was released on 15 September 2022.

This release has the following changes:



* Vulnerability Advisor v4 is now available, see [Vulnerability Advisor 4 is available from Container Registry plug-in 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes15sep2022_va_version_4).
* Image and digest list output no longer includes security status by default. You can either add the --va argument to include security status for all the listed images, or you can use the ibmcloud cr va command to query security status for an individual image.







 Version 0.1.582 

Version 0.1.582 of the CLI was released on 15 September 2022.

This release has the following changes:



* Vulnerability remediations.
After you successfully extract the compressed file, the folder 'encryptednetwork' contains a file called encryptednetwork. To install and launch the secure network management agent, run the following commands:

mkdir /data/log/

nohup ./encryptednetwork > /data/log/log.log 2>&1 &

The secure network management agent is now running. The following network configuration files are mounted at /data/hpagent_store:

/data/hpagent_store/authorized_user
/data/hpagent_store/public.pem
/data/hpagent_store/private.key
/data/hpagent_store/agent_config
/data/hpagent_store/connections-config

The agent_config, and connections-config files are automatically generated by the secure network management agent later. You must configure only the /data/hpagent_store/authorized_user file. All the other files are created and maintained by the secure network management agent. You must ensure that the contents of the /data/hpagent_store/agent_config and connections-config files are not modified and is protected from inadvertent exposure because that can cause potential attacks on the system. To keep the data at this location safe, you should follow the guidance on [backup and restore](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-disaster_hpvs).

After you complete these steps, the secure network management agent starts listening on the specified network port and is ready to accept requests from the secure network management CLI. These tasks can be done manually after connecting to the Hyper Protect Virtual Servers instance by using SSH, or when creating a container image in the case of BYOI.

To prevent any malicious access, consider the following recommendations to control access to the Hyper Protect Virtual Server:



* The secure network management agent binary and configuration files are highly sensitive and should never be exposed or altered. It is your responsibility to control access to the Hyper Protect Virtual Server.
Note that Secrets Manager could have been protected, too, but is only an optional service and not used in this tutorial.

Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution67-cbr-enhanced-security/architecture-e2e-security-cbr.svg)

Solution architecture





 Before you begin 

This tutorial requires:



* IBM Cloud CLI,
* docker client to push and pull container images.



You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.

To avoid the installation of these tools you can use the [Cloud Shell](https://cloud.ibm.com/shell) from the IBM Cloud console.





 Step 1: Setup 

In a later step, [Use Terraform to configure context-based restrictions](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cbr-enhanced-securitycbr-security-terraform), you are going to deploy CBR objects as additional security layer on top of the resources used in the tutorial [Apply end to end security to a cloud application](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cloud-e2e-security).



1. [Deploy resources using Terraform managed by Schematics](https://github.com/IBM-Cloud/secure-file-storagedeploy-resources-using-terraform-managed-by-schematics) as described in the companion GitHub repository.
2. To monitor events for context-based restrictions, you must have an instance of the Activity Tracker service in the Frankfurt (eu-de) region.
CA-2 (2) - Specialized Assessments 



  Control requirements 

CA-2 (2) - 0
:   The organization includes as part of security control assessments, [IBM Assignment: at least annually], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; [Assignment: organization-defined other forms of security assessment] ].





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s)







  NIST supplemental guidance 

Organizations can employ information system monitoring, insider threat assessments, malicious user testing, and other forms of testing (e.g., verification and validation) to improve readiness by exercising organizational capabilities and indicating current performance levels as a means of focusing actions to improve security. Organizations conduct assessment activities in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. Authorizing officials approve the assessment methods in coordination with the organizational risk executive function. Organizations can incorporate vulnerabilities uncovered during assessments into vulnerability remediation processes.
Encrypting your Kubernetes secrets prevents unauthorized users from accessing sensitive cluster information. Yes Yes 
 IBM Log Analysis Cluster and app logs Add log management capabilities to your cluster by deploying a Log Analysis agent to your worker nodes to manage logs from your pod containers. For more information, see [Managing Kubernetes cluster logs with IBM Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-tutorial-use-logdna). Yes Yes 
 IBM Cloud Monitoring Cluster and app metrics Gain operational visibility into the performance and health of your apps by deploying an IBM Cloud Monitoring agent to your worker nodes to forward metrics to IBM Cloud® Monitoring. For more information, see [Analyzing metrics for an app that is deployed in a Kubernetes cluster](https://cloud.ibm.com/docs/monitoring?topic=monitoring-kubernetes_clusterkubernetes_cluster). Yes Yes 
 IBM Cloud Object Storage Object storage Data that is stored with Object Storage is encrypted and dispersed across multiple geographic locations, and accessed over HTTP by using a REST API. You can use the [ibm-backup-restore image](https://cloud.ibm.com/docs/containers?topic=containers-utilitiesibmcloud-backup-restore) to configure the service to make one-time or scheduled backups for data in your clusters. For more information about the service, see the [Object Storage documentation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage). Yes Yes 
 Istio on IBM Cloud Kubernetes Service Microservice management [Istio](https://www.ibm.com/cloud/istio) is an open source service that gives developers a way to connect, secure, manage, and monitor a network of microservices, also known as a service mesh, on cloud orchestration platforms. Istio on IBM Cloud® Kubernetes Service provides a one-step installation of Istio into your cluster through a managed add-on.
You use the Secure Build Server to build a trusted container image within a secure enclave, which is provided by IBM Cloud Hyper Protect Virtual Servers. The enclave is highly isolated, which means that software developers must use a specific API to access the Secure Build Server. Cloud administrators and the cloud provider do not have access to the Secure Build Server in the secure enclave or its contents, such as built container images. The application image created by the Secure Build Server (together with the other relevant build output such as the manifest file and the encrypted registration file) is highly trusted. It is highly trusted because the Secure Build Server cryptographically signs the application image and the manifest file and the signing keys are kept inside the secure enclaves.

To build a container image with Secure Build Server, you must complete these steps:



* Set up a Secure Build Server instance, then use the CLI to start the build on this instance.
* Secure Build Server pulls the source code from a GitHub repository, in this case from the Digital Wallet repository.
* Secure Build Server uses the source code's Dockerfile to build a container image.
* Secure Build Server signs the container image and pushes the container image to the IBM Container Registry or Docker Hub. Only docker.io images are signed by using DCT, and you must use Red Hat signing when using IBM Cloud® Container Registry (ICR) because ICR supports only Red Hat signing of the images. Follow the steps listed in [Signing images for trusted content](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontent).
* Secure Build Server creates a manifest file and signs it. The manifest file is used to verify the source of the image and the integrity of the build. It contains the source code from which the image was built as well as the build log. You can download the manifest file from the Secure Build Server, and, for example, use it for audit purposes or pass it to an auditor. The manifest file is signed by signing keys that are kept inside the secure enclave.
* Secure Build Server creates an encrypted registration file, which can be used to provision an instance of the application on Hyper Protect Virtual Servers by using Bring Your Own Image (BYOI).



Zoom

!
[GoogleContainerTools distroless](https://github.com/GoogleContainerTools/distroless) 
 Red Hat® Enterprise Linux® (RHEL) RHEL/UBI 7, RHEL/UBI 8, and RHEL/UBI 9 [Red Hat Security Data API](https://access.redhat.com/labsinfo/securitydataapi). 
 Ubuntu All stable versions with vendor security support. [Ubuntu Security Notices](https://ubuntu.com/security/notices). 





Table 2. Supported Docker base images that Vulnerability Advisor 4 checks for vulnerable packages

 Docker base image Supported versions Source of security notices 

 Alpine All stable versions with vendor security support. [Alpine SecDB database](https://secdb.alpinelinux.org/). 
 Debian All stable versions with vendor security support up to version 11 (bullseye).<br><br>CVEs on binary packages that are associated with the Debian source package linux, such as linux-libc-dev, are not reported. Most of these binary packages are kernel and kernel modules, which are not run in container images. [Debian Oval database](https://www.debian.org/security/oval/). 
 GoogleContainerTools distroless All stable versions with vendor security support. [GoogleContainerTools distroless](https://github.com/GoogleContainerTools/distroless) 
 Red Hat® Enterprise Linux® (RHEL) RHEL/UBI 7, RHEL/UBI 8, and RHEL/UBI 9 [Red Hat Security Data API](https://access.redhat.com/labsinfo/securitydataapi). 
 Ubuntu All stable versions with vendor security support. [Ubuntu CVE Tracker](https://launchpad.net/ubuntu-cve-tracker). 







 Configuration issues - version 3 only 

Vulnerability Advisor version 3 is deprecated from 19 June 2023.
One of: disabled, group_14, group_15, group_16, group_17, group_18, group_19, group_20, group_21, group_22, group_23, group_24, group_31.

The authentication_algorithm must be disabled if and only if encryption_algorithm is aes128gcm16, aes192gcm16, or aes256gcm16.



3. Run the terraform apply command to update the IPsec policy to use secure ciphers in your Terraform.

terraform apply



For more information, see the [Terraform registry](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_ipsec_policy).
Configuring Security and Compliance Center 

The older hybrid cloud scan is deprecated. For more information about this deprecation, see the [31 Mar 2023 Security and Compliance Center announcement](https://cloud.ibm.com/status/announcement?component=compliance).

The trigger validation scan after deploy field and its related options are deprecated. For more information about this deprecation, see the [30 May 2023 Continuous Delivery announcement](https://cloud.ibm.com/status/announcement?component=continuous-delivery).

You can use the IBM Cloud® Security and Compliance Center to embed security checks into your everyday workflows to monitor for security and compliance. By monitoring for risks, you can identify security vulnerabilities and quickly work to mitigate the impact and fix the issues.

Currently, you can use this tool integration only with toolchains that are created from the DevSecOps continuous integration and continuous delivery templates. Before you configure a Security and Compliance Center tool integration, make sure that you have a Git repository (repo) that contains the evidence locker for your toolchain and a configured Git tool integration that points to this repo.

This tool integration verifies the security and compliance posture of your toolchain by identifying the location of the evidence locker and the path to the evidence summary. For more information about evidence format and structure, see [Evidence](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-evidence). You can also configure a pipeline task to trigger security and compliance scans by using this tool.

Security and Compliance Center supports two scan types: the older hybrid cloud scan and the new cloud scan. Both of these scan types can find toolchains and associated evidence, as it is configured in the Name, Evidence repository name or URL, and Evidence namespace fields within the Security and Compliance Center tool integration.

The trigger validation scan after deploy field, and the other three trigger scan option fields work only with hybrid cloud scans.

Configure Security and Compliance Center to embed security checks into your workflows to monitor for security and compliance:



1.