vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Data security & encryption 

The IBM® Db2® Warehouse on Cloud service has security built into all levels of its architecture.

The following methods are used to secure your data:



*  Data at rest and database backups are encrypted using NIST SP 800-131A compliant cryptographic algorithms
*  Data in motion is encrypted through SSL/TLS
*  When deployed to IBM Cloud, backplane network connectivity is supported through IBM Cloud Service Endpoints
*  When deployed to Amazon Web Services, backplane network connectivity is supported through Amazon Web Services PrivateLink
*  Database-level security is supported through Role-Based Access Control (RBAC) and Row and Column Access Control (RCAC)
*  Inter-node encryption is always enabled for the current generation of plans hosted on AWS. It can optionally be enabled for your Flex or Flex Performance instance hosted on IBM Cloud. For more information, see [Inter-node encryption](https://cloud.ibm.com/docs/Db2whc?topic=Db2whc-Inter-node)



Encrypted connections are enforced by default. For more information, see [SSL connectivity](https://cloud.ibm.com/docs/Db2whc?topic=Db2whc-ssl_support).
The term security labeling refers to the association of security attributes with subjects and objects represented by internal data structures within organizational information systems, to enable information system-based enforcement of information security policies. Security labels include, for example, access authorizations, data life cycle protection (i.e., encryption and data expiration), nationality, affiliation as contractor, and classification of information in accordance with legal and compliance requirements. The term security marking refers to the association of security attributes with objects in a human-readable form, to enable organizational process-based enforcement of information security policies. The AC-16 base control represents the requirement for user-based attribute association (marking). The enhancements to AC-16 represent additional requirements including information system-based attribute association (labeling). Types of attributes include, for example, classification level for objects and clearance (access authorization) level for subjects. An example of a value for both of these attribute types is Top Secret.
How can I secure a workspace by setting an environment variable? 

Currently, the IBM Cloud Schematics service team is working to enable secure environment variables and support for passing credentials for modules. It is planned in the future roadmap. However, here is a sample code block to secure a workspace.


Example input file get workspace:
"env_values": [{
"name": "GIT_ASKPASS",
"value": "./git-askpass-helper.sh",
"secure": false,
"hidden": false
},
{
"name": "GIT_PASSWORD",
"value": "plain text token",
"secure": false,
"hidden": false
}
]

Show more





 How can I create ibm_function_trigger with Terraform that connects to an Event Stream? 

The sample code block allows to create the resources of the same type in a sequential order. For more information, about creating a trigger that listens to an Event Streams instance block, see [Event Streams_trigger](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-pkg_event_streamseventstreams_trigger).

 {: codeblock}
resource "ibm_function_trigger" "trigger" {
name = "event - trigger"
namespace = "ns01"
user_defined_annotations = jsonencode([])
user_defined_parameters = jsonencode([])
feed {
name = "/whisk.system/messaging / messageHubFeed"
parameters = jsonencode([])
}
}






 How do I associate a public gateway while creating multiple zones with a Subnet for each zone? 


{

"StatusCode": 400,
"Headers": {

"Cache-Control": ["max-age=0, no-cache, no-store, must-revalidate"],
"Cf-Cache-Status": ["DYNAMIC"],
For example, ensure that all physical storage is encrypted by using keys that are managed by a hardware security module (HSM) in your IaaS / data center.<br> * Ensure that data in transit is always encrypted by using TLS 1.2 or higher, including all traffic within your IaaS / data center environment.<br> * Use TLS offload for firewalls / load balancers that perform TLS termination for requests from outside of your IaaS / data center environment and protected by a certificate that is signed by a public certificate authority.<br><br><br> 
 [Implement business continuity and disaster recovery](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-bcdr) <br><br> * Implement a system for business continuity and disaster recovery (BCDR). Define Recovery Point Objective (RPO), Recovery Time Objective (RTO), and Maximum Tolerable Downtime (MTD) metrics for essential business functions. Implement your application so that the metrics are achieved. An alternative storage region in IBM Cloud should be used to meet control requirements. For more information, see [Business continuity and disaster recovery for Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-bcdr).<br> * Follow best practices for BCDR as defined by the specific IBM Cloud-managed services that you use such as Hyper Protect Crypto Services, Object Storage, and so on. For more infomration, see [Backup and disaster recovery for IBM Cloud services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdribm-cloud-services).<br><br><br> <br><br> * Implement a system for BCDR. Define Recovery Point Objective (RPO), Recovery Time Objective (RTO), and Maximum Tolerable Downtime (MTD) metrics for essential business functions within your IaaS / data center and ensure that those metrics are achieved.
PS-1 - Personnel Security Policy and Procedures 



  Control requirements 

The organization:

PS-1 (a)
:   Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:



1.  A personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2.  Procedures to facilitate the implementation of the personnel security policy and associated personnel security controls; and



PS-1 (b)
:   Reviews and updates the current:



1.  Personnel security policy [IBM Assignment: at least annually]; and
2.  Personnel security procedures [IBM Assignment: at least annually].







  NIST supplemental guidance 

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the PS family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.
Event forwarding 

IBM Cloud® Security and Compliance Center Workload Protection supports sending different types of security data to third-party SIEM (security information and event management) platforms and logging tools, such as Splunk, Elastic Stack, Qradar, and Arcsight. Use Event Forwarding to integrate with these platforms and logging tools so you can view security events and correlate Workload Protection findings with the tool that you are already using for analysis.

IBM Cloud Security and Compliance Center Workload Protection implements Sysdig Secure functionality. Information that is provided by the Sysdig Secure documentation applies to Workload Protection as well.

For more information, see [Event forwarding](https://docs.sysdig.com/en/docs/sysdig-secure/secure-events/event-forwarding/)
--------------------



  Identifying software vulnerabilities 

You can also use the IBM Cloud Monitoring Workload Protection service to find and prioritize software vulnerabilities, detect and respond to threats, and manage configurations, permissions and compliance from source to run.

The ability to monitor software vulnerabilities is included when you use the [Graduated Tier - Sysdig Secure + Monitor service plan](https://cloud.ibm.com/docs/monitoring?topic=monitoring-service_plans). This plan integrates IBM Cloud Security and Compliance Center Workload Protection as part of IBM Cloud Monitoring.

For more information, see the [IBM Cloud Security and Compliance Center Workload Protection documentation.](https://cloud.ibm.com/docs/workload-protection)
Security 

Use the powerful tools of IBM Cloud® Schematics to build and spin up your IBM Cloud environment, automate cloud resource operations, install software, and run multitiered apps on your cloud resources. The IBM Cloud Schematics also ensures that your data stays secure and protected.



 Secure access control 

The list of feature in the table states Schematics has a multitude of built-in security features for you to control access to data.



Schematics security features

 Feature Description 

 Authentication Schematics is accessed by using the API endpoint. The user gets authenticated for every request that it receives. Schematics supports IAM access controls. For more information, see [Authentication](https://cloud.ibm.com/apidocs/schematics/schematicsauthentication). 
 Authorization Use IAM roles to control access to Schematics. For more information, see the [Managing user access](https://cloud.ibm.com/docs/schematics?topic=schematics-access). 
 At-rest encryption All data that is stored in Schematics instance is encrypted using envelope encryption with AES GCM 256. By default, Schematics manages the encryption keys in its own Key Protect instances for all environments. If you require bring-your-own-key (BYOK) encryption for encryption-at-rest, BYOK is enabled by using your encryption key that is stored in an IBM Cloud Key Protect instance in your account. For more information, see [KMS integration for BYOK or KYOK](https://cloud.ibm.com/docs/schematics?topic=schematics-kms-integrationkey-mgt-ui). 
 In-flight encryption All access to Schematics is encrypted by using HTTPs. 
 Public Endpoints All Schematics instances are provided with [external endpoints](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-datapi-location) that are publicly accessible. 
 Private Endpoints Allows clients to connect to a Schematics instance through the internal IBM Cloud network to avoid upstream application traffic from going over the public network and incurring bandwidth charges.
Securing your data in Continuous Delivery 

The Continuous Delivery service encrypts customer-owned sensitive data before it stores it in databases that are used internally by the service.

IBM Cloud® Continuous Delivery hosts your databases in a highly available and secure environment:



* Data is encrypted at rest (GPFS, LUKS, and built-in disk) and in transit (HTTPS and SSH) by using encryption keys that are internal to the Continuous Delivery service, or the services and infrastructure that it depends on.
* Client and system credentials are stored on encrypted disks.
* Configuration data for tool integrations and Delivery Pipeline property values might include sensitive information. This data is encrypted by using encryption keys that are internal to the Continuous Delivery service because it is stored in databases that are internal to the service.
* The application and data are configured for high availability.
* Access to data is limited to only those users who require the data to support and maintain the service.



Continuous Delivery does not support encryption that uses customer-provided keys.



 Protecting your sensitive data in Continuous Delivery 

Sensitive data includes third-party tool integration configuration data and Delivery Pipeline property values. Data is encrypted by using encryption keys that are internal to the Continuous Delivery service.

DevOps processes often require various types of credentials (such as usernames and passwords, API keys, service keys, and SSH keys) to interact with other systems to build, test, and deploy applications. You are responsible for ensuring that these credentials aren't inadvertently shared outside of their intended audience. Access to these credentials by malicious actors might disrupt your IT operations, cause unexpected costs, or use your resources to start attacks. IBM is not responsible for protecting and maintaining the security of your credentials.

To keep your credentials secure, make sure that you follow this guidance:



* Do not store credentials in Git repos. Depending on the repo settings, files within a repo might be visible to other members of your organization, other IBM Cloud users, or the public internet.
* Do not include user credentials in Delivery Pipeline definitions because they might be visible to other users. Specifically, do not place user credentials within Delivery Pipeline Classic job definition scripts, Delivery Pipeline Tekton yaml files, or scripts that are started by delivery pipelines.
Configuring Key Protect 

IBM® Key Protect for IBM Cloud® helps you to securely store and apply secrets for apps across IBM Cloud services.

A secret is anything that provides access to sensitive information, such as an [API key](https://cloud.ibm.com/docs/account?topic=account-manapikey). If you store secrets as standard keys in Key Protect, you can use this tool integration to access secrets wherever they are needed in the toolchain workflow. To learn more about standard keys in Key Protect, see [Key types](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryptionkey-types).

Before you configure a Key Protect tool integration, make sure that you have an instance of the Key Protect service provisioned in the region and resource group that you want to create the tool integration in. In certain scenarios, a Key Protect service instance can be automatically generated. For example, if you are minting a new API key and choose to store it as a secret for later use, you automatically generate the Key Protect service instance. For instructions to provision an instance of the Key Protect service, see [Provisioning the service](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-provision).

Configure Key Protect to securely manage secrets that are part of your toolchain:



1. If you are configuring this tool integration as you are creating the toolchain, in the Configurable Integrations section, click Key Protect. If Key Protect is defined as an optional tool integration, it is located under More Tools.
2. If you have a toolchain and are adding this tool integration to it, from the IBM Cloud console, click the menu icon ![hamburger icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/icon_hamburger.svg) and select DevOps.
Encryption <br><br> * Automatically apply security patch updates for infrastructure.<br> * Enable certain security settings, such as encrypted disks.<br> * Disable certain insecure actions, such as allowing users to SSH into the host.<br> * Encrypt communication with TLS.<br> * Continuously monitor IBM Cloud App Configuration entities to detect vulnerability and security compliance issues.<br> * Integrate IBM Cloud App Configuration with IBM Cloud Identity and Access Management (IAM).<br><br><br> Manage IBM Cloud credentials, and keep credentials secure. 







 Disaster recovery 

IBM is responsible for the recovery of IBM Cloud App Configuration components in case of disaster.

You are responsible for the recovery of the workloads that run IBM Cloud App Configuration and your application and application data.



Table 5. Responsibilities for disaster recovery

 Task IBM Responsibilities Your Responsibilities 

 Availability <br><br> * Provide high availability capabilities, such as IBM-owned infrastructure in multizone regions, to meet local access and, low latency requirements for each supported region.<br> * Run IBM Cloud App Configuration deployments with three replicas in the same region for high availability.<br> * Continuously monitor IBM Cloud App Configuration infrastructure to ensure the reliability and availability of the service environment by site reliability engineers.<br> * Maintain service availability across [worldwide regions](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-regions-endpointsac-regions) so that customers can deploy projects across zones and regions for higher DR tolerance.<br><br><br> <br><br> * Use the list of [available regions](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-regions-endpointsac-regions) to plan and create new instances of the service to meet performance and availability requirements beyond the default that is provided by IBM.<br> * Set up more IBM Cloud App Configuration instances across zones and regions to increase disaster recovery tolerance above the default provided by IBM.<br><br><br>
Rules for SA-4 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 SA-4 (a) <br><br> * Check whether provisioned services are IAM enabled<br> * Check whether the Financial Services Validated setting is enabled in account settings<br><br><br> 
 SA-4 (b) <br><br> * Check whether provisioned services are IAM enabled<br><br><br> 
 SA-4 (c) <br><br> * Check whether provisioned services are IAM enabled<br><br><br> 
 SA-4 (d) <br><br> * Check whether provisioned services are IAM enabled<br><br><br> 
 SA-4 (e) <br><br> * Check whether provisioned services are IAM enabled<br><br><br> 
 SA-4 (f) <br><br> * Check whether provisioned services are IAM enabled<br><br><br> 
 SA-4 (g) <br><br> * Check whether provisioned services are IAM enabled<br><br><br> 







 NIST supplemental guidance 

Information system components are discrete, identifiable information technology assets (e.g., hardware, software, or firmware) that represent the building blocks of an information system. Information system components include commercial information technology products. Security functional requirements include security capabilities, security functions, and security mechanisms. Security strength requirements associated with such capabilities, functions, and mechanisms include degree of correctness, completeness, resistance to direct attack, and resistance to tampering or bypass. Security assurance requirements include: (i) development processes, procedures, practices, and methodologies; and (ii) evidence from development and assessment activities providing grounds for confidence that the required security functionality has been implemented and the required security strength has been achieved. Security documentation requirements address all phases of the system development life cycle. Security functionality, assurance, and documentation requirements are expressed in terms of security controls and control enhancements that have been selected through the tailoring process.
[Menu icon](https://cloud.ibm.com/docs-content/v1/content/a6478671e8f845a84102d9cf49bf28ee7f4f3227/icons/icon_hamburger.svg)> Security and Compliance > Govern resources > Configure > Templates, or check out the [API reference](https://cloud.ibm.com/apidocs/security-compliance-config) to learn more about creating templates programmatically.

For more information, see [What is Configuration Governance?](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-rules-define)





 17 February 2021 

Manage your own encryption
: If you're using Security and Compliance Center to monitor your current posture, you can now manage your encryption settings in the Data settings tab of the service UI.

By default, the data that is generated by the Security and Compliance Center is encrypted at rest by IBM. To control the encryption of your data, you can enable a key management service and select your own key. For more information, see [Protecting your sensitive data](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-mng-data).

New goals
: You might notice that your compliance score changed even though you didn't update any of your configurations. 51 new goals were added to the IBM profiles that your resources are automatically scanned for. For detailed descriptions of the new goals, you can review the IBM Best Practices Controls 1.0 profile. All the goals with ID's in the following ranges are new.



* Goal ID's: 3000110 - 3000117
* Goal ID's: 3000256 - 3000279
* Goal ID's: 3000311 - 3000320
* Goal ID's: 3000631 - 3000639







 15 December 2020 

Updated Scopes page
: An improved experience is now available for viewing, creating, and deleting scopes.

Updated Inventory page
: You can now delete inventories that you no longer require.

New dashboard widget
To find out more about the issues, click the link in the Security status column.

The Vulnerability Advisor dashboard provides an overview and assessment of the security for an image. If you want to find out more about the Vulnerability Advisor dashboard, see [Reviewing a vulnerability report](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_reviewing).

Encrypted images aren't scanned by Vulnerability Advisor.



 Data protection 

To scan images and containers in your account for security issues, Vulnerability Advisor collects, stores, and processes the following information:



* Free-form fields, including IDs, descriptions, and image names (registry, namespace, repository name, and image tag)
* Metadata about the file modes and creation timestamps of the configuration files
* The content of system and application configuration files in images and containers
* Installed packages and libraries (including their versions)



Do not put personal information into any field or location that Vulnerability Advisor processes, as identified in the preceding list.

Scan results, aggregated at a data center level, are processed to produce anonymized metrics to operate and improve the service. In version 3, a vulnerability report (scan result) is generated when the image is pushed to the registry (and is regenerated regularly thereafter). When Vulnerability Advisor is queried, a scan result is retrieved that might be up to 5 days old. Scan results are deleted 30 days after they are generated.

In version 4, the image is indexed when it is first pushed to Container Registry registry, and that index report is stored in the database. When Vulnerability Advisor is queried, the image index report is retrieved, and a vulnerability assessment is produced. This action happens dynamically every time Vulnerability Advisor is queried. Therefore, no pregenerated scan result exists that requires deleting. However, the image index report is deleted within 30 days of the deletion of the image from the registry.







 Types of vulnerabilities 



 Vulnerable packages 

Vulnerability Advisor checks for vulnerable packages in images that are using supported operating systems and provides a link to any relevant security notices about the vulnerability.

Packages that contain known vulnerability issues are displayed in the scan results.
Activity audit 

Activity audit takes the high-value data from captures and makes it always-on, searchable, and indexed against your cloud-native assets. This stream includes commands that are run, network activity, file activity, and kube exec requests to the Kubernetes API.

IBM Cloud Security and Compliance Center Workload Protection implements Sysdig Secure functionality. Information that is provided by the Sysdig Secure documentation applies to Workload Protection as well.

For more information, see [Activity audit](https://docs.sysdig.com/en/docs/sysdig-secure/investigate/activity-audit/)