vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Secured Docker private image repository in IBM Cloud Container Registry Set up your own Docker [image repository](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgetting-started) in a multi-tenant, highly available, and scalable private image registry that is hosted and managed by IBM. By using the registry, you can build, securely store, and share Docker images across cluster users. /n Learn more about [securing your personal information](https://cloud.ibm.com/docs/containers?topic=containers-securitypi) when you work with container images. 
 Push images with trusted content only Ensure the integrity of your images by enabling [content trust](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontentregistry_trustedcontent) in your image repository. With trusted content, you can control who can sign images as trusted and push images to a specific registry namespace. After trusted signers push an image to a registry namespace, users can pull the signed content so that they can verify the publisher and the integrity of the image. 
 Automatic vulnerability scans When you use IBM Cloud Container Registry, you can leverage the built-in security scanning that is provided by [Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_registry_cli). Every image that is pushed to your registry namespace is automatically scanned for vulnerabilities against a database of known CentOS, Debian, Red Hat, and Ubuntu issues. If vulnerabilities are found, Vulnerability Advisor provides instructions for how to resolve them to ensure image integrity and security. 
 Block deployments from vulnerable images or untrusted users Create an admission controller with custom policies so that you can verify container images before you deploy them. With the [open source Portieris project](https://github.com/IBM/portieris), you control where the images are deployed from and ensure that they meet content trust requirements. If a deployment does not meet the policies that you set, the admission controller blocks the deployment in your cluster. 



What options do I have to scan running containers for vulnerabilities?
If you use enforcement in your container runtime environment, you might be prevented from deploying that image unless all issues are exempted by your policy.

If your image does not meet the requirements that are set by your organization's policy, you must configure the image to meet those requirements before you can deploy it. For more information about how to view and change the organization policy, see [Setting organizational exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_managing_policy).



 Reviewing a vulnerability report by using the console - version 3 only 

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

You can review the security of Docker images that are stored in your namespaces in IBM Cloud Container Registry by using the IBM Cloud console. Version 4 does not support viewing vulnerability reports in the console, but you can use the CLI or the API.



1. Log in to IBM Cloud.
2. Click the Navigation menu icon, then click Container Registry.
3. Click Images. A list of your images and the security status of each image is displayed in the Images table.
4. To see the report for the image that is tagged latest, click the row for that image. The Image details tab opens showing the data for that image. If no latest tag exists in the repository, the most recent image is used.
5. If the Security status column shows any issues, to find out about the issues, click the Issues by type tab. The Vulnerabilities and Configuration Issues tables open.



* Vulnerabilities table. Shows the Vulnerability ID for each issue, the policy status for that issue, the affected packages and how to resolve the issue. To see more information about that issue, expand the row. A summary of that issue is displayed that contains a link to the vendor security notice for that issue.
The static-scan task runs a scan on the specified repos.
* If you don't have your own SonarQube instance, the pipeline creates a SonarQube instance during the pipeline run. You can access this instance after the static-scan stage successfully runs.
* Add your own static scan code to the static-scan custom stage in your .pipeline-config.yaml file for a custom implementation.





 Adding SonarQube scan to your pipelines 

For more information about integrating SonarQube with the continuous integration pipeline, see [Configuring SonarQube](https://cloud.ibm.com/docs/devsecops?topic=devsecops-sonarqube).







 Scans and checks in compliance checks 



Table 5. Compliance scans and checks

 Scan or check Description 

 Detect secrets The [IBM Detect Secrets](https://github.com/IBM/detect-secrets) tool identifies where secrets are visible in app code. 
 Code Risk Analyzer vulnerability scan Finds vulnerabilities for all of the app package dependencies, container base images, and operating system packages. Uses the Code Risk Analyzer tool. 
 Code Risk Analyzer CIS check Runs configuration checks on Kubernetes deployment manifests. Uses the Code Risk Analyzer tool. 
 Code Risk Analyzer Bill of Material (BOM) check The BOM for a specified repo that captures the pedigree of all of the dependencies. This BOM is collected at different granularities. For example, the BOM captures the list of base images that are used in the build, the list of packages from the base images, and the list of app packages that are installed over the base image. The BOM acts as a ground truth for the analytic results and can potentially be used to enforce policy gates. Uses the Code Risk Analyzer tool. 
 Repository compliance checking Checks that branch protection settings are correct. For example, the master/main branch should always restrict the force push.
For more information, see [Using an API key with Secrets Manager to authorize a project to deploy an architecture](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-authorize-project).
2. During validation, a Code Risk Analyzer scan is run on your architecture. Select the controls that you want to use during validation. You can use the Architecture default controls, or the Select from Security and Compliance Center option if you have an attachment set up in your target account.

If you select Architecture default:



* The scan uses the default controls that the owner of the deployable architecture added when they onboarded it.
* Controls that the architecture owner added that are also included in the [supported set of Security and Compliance Center rules](https://cloud.ibm.com/docs/code-risk-analyzer-cli-plugin?topic=code-risk-analyzer-cli-plugin-cra-cli-pluginterraform-scc-goals) are checked.
* Any extra controls that the architecture owner added that are not included in the list of supported rules are not checked when you validate your configuration.
* If the owner of the deployable architecture didn't add compliance controls to their product, the full set of Security and Compliance Center rules is used.



To view the list of added controls, go the [IBM Cloud catalog](https://cloud.ibm.com/catalog) and select the deployable architecture that you're configuring. The Security & compliance tab lists all of the controls that were added to the deployable architecture.

If you select Select from Security and Compliance Center, you must have an instance of the service and an attachment through Security and Compliance Center in the target account that you want to deploy to. For help creating an attachment, see [Evaluating resource configuration with IBM Cloud Security and Compliance Center](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-security-compliance-scanning).
3. From the Required panel, enter values for the required fields for the deployable architecture configuration.
4. Optional: You can add values by going to the Optional panel.
5.
qemu-img check --object secret,id=sec0,data=abc123 --image-opts driver=qcow2,encrypt.key-secret=sec0,file.filename=my_100G_custom_image-encrypted.qcow2

For this example, you'd see a response similar to the following output:

No errors were found on the image.
16343/1638400 = 1.00% allocated, 0.00% fragmented, 0.00% compressed clusters
Image end offset: 1074790400
7. Run info on your new, encrypted file to verify that it is the size and encryption level you expect.

qemu-img info my_100G_custom_image-encrypted.qcow2

For this example, you'd see a response similar to the following output:

image: my_100G_custom_image-encrypted.qcow2
file format: qcow2
virtual size: 100 GiB (107374182400 bytes)
disk size: 1.27 GiB
cluster_size: 65536
Format specific information:
compat: 1.1
lazy refcounts: false
refcount bits: 16
corrupt: false







 Upload the encrypted image to IBM Cloud Object Storage 

When your image file is encrypted with LUKS encryption and your unique passphrase, you can upload it to IBM Cloud Object Storage by completing the following steps:



1. Make sure that your customized image file has a descriptive name so that you can easily identify it later.
2. On the Objects page of your IBM Cloud Object Storage bucket, click Upload. You can use the Aspera high-speed transfer plug-in to upload images larger than 200 MB.







 Setting up your key management service and keys 

To import an encrypted custom image to IBM Cloud VPC, you need a key management service provisioned. You also need a customer root key (CRK) and a wrapped data encryption key (WDEK).
This communication uses APIs to pull powerful IBM QRadar data into the QRadar Security Information and Event Management (SIEM) dashboards.
* IBM® Security Threat Investigator automatically analyzes and investigates cases to help you make more informed decisions.
* IBM® Security Risk Manager provides early visibility into potential security risks by correlating insights from multiple vectors to help you prioritize remedial actions based on prescriptive recommendations.
* Detection and Response Center (Beta) provides a unified overview of your organization's security posture through use cases from different security tools and platforms.



For more information, see [IBM Documentation](https://www.ibm.com/docs/en/cloud-paks/cp-security/saas).





 Purchasing a license 

Before you can use IBM Cloud Pak® for Security as a Service, you must purchase a license. Purchase a license, also known as an entitlement, at [IBM Passport Advantage](https://www.ibm.com/software/passportadvantage/index.html).

For more information, see [Licensing and entitlement](https://www.ibm.com/docs/en/cloud-paks/cp-security/1.7.0?topic=only-licensing).





 Getting started in SaaS 

When your IBM Cloud Pak® for SaaS deployment is available, you receive a Welcome email from IBM Security which contains important information, including a list of initially provisioned users and links to your IBM Verify and IBM Cloud Pak for SaaS deployment. Provisioned users can then create additional users as needed. These users can log on to your IBM Cloud Pak for SaaS deployment and your instance of IBM Verify, which is used for identify management.

Only users who have an IBMid associated with their email address are included in the list of initially provisioned users.

To log on to your IBM Cloud Pak for Security as a Service deployment, use the URL included in the welcome email, select Enterprise SAML as the authentication method, and then click Sign in with IBMid.





 Creating users in IBM Cloud Pak for SaaS 

Users who are listed as provisioned in the Welcome email can create additional users.





 Before you begin
Encrypting VHD images 

To use the E2E Encryption feature, you must encrypt your Virtual Hard Drive (VHD) image with the vhd-util tool before you import it into Image Templates to provision encrypted instances. Two levels of AES encryption are supported: AES 256 bit and AES 512 bit.



 Encrypted VHD image requirements 

Encrypted VHD images must meet the following requirements:



* VHD formatted.
* Compatibility with the IBM Cloud® Console infrastructure environment.
* Provisioned with a [supported OS](https://cloud.ibm.com/docs/image-templates/?topic=image-templates-preparing-and-importing-imagespreparing-and-importing-images).
* Cloud-init enabled.
* Encrypted with [the vhd-util tool](https://cloud.ibm.com/docs/image-templates?topic=image-templates-create-encrypted-imagevhd-util-tool).







 Encrypting your VHD image 

Follow these steps to create your encrypted VHD image:



1. Select a CentOS system version 7 or higher to encrypt your virtual disk image (VHD file) for IBM Cloud. If you don't have access to physical hardware with CentOS installed, you can provision a virtual server instance with CentOS 7 inside IBM Cloud by using either a public or dedicated host. The CentOS system used to encrypt VHD files need not be encrypted itself.
2. Download the encryption tool from IBM Cloud, then use the best available option to encrypt your VHD.

Option 1 If your CentOS system is not running in IBM Cloud, log in and connect to your customer [VPN](https://www.ibm.com/cloud/vpn-access). For more information about setting up a VPN, see [Set up SSL VPN connections](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-setup-ipsec-vpn).
If you use enforcement in your container runtime environment, you might be prevented from deploying that image unless all issues are exempted by your policy.

If your image does not meet the requirements that are set by your organization's policy, you must configure the image to meet those requirements before you can deploy it. For more information about how to view and change the organization policy, see [Setting organizational exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_managing_policy).



 Reviewing a vulnerability report by using the console - version 3 only 

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

You can review the security of Docker images that are stored in your namespaces in IBM Cloud Container Registry by using the IBM Cloud console. Version 4 does not support viewing vulnerability reports in the console, but you can use the CLI or the API.



1. Log in to IBM Cloud.
2. Click the Navigation menu icon, then click Container Registry.
3. Click Images. A list of your images and the security status of each image is displayed in the Images table.
4. To see the report for the image that is tagged latest, click the row for that image. The Image details tab opens showing the data for that image. If no latest tag exists in the repository, the most recent image is used.
5. If the Security status column shows any issues, to find out about the issues, click the Issues by type tab. The Vulnerabilities and Configuration Issues tables open.



* Vulnerabilities table. Shows the Vulnerability ID for each issue, the policy status for that issue, the affected packages and how to resolve the issue. To see more information about that issue, expand the row. A summary of that issue is displayed that contains a link to the vendor security notice for that issue. Lists packages that contain known vulnerability issues.
[DevSecOps Image Signing](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-ci-image-signing.png)

Figure 16. DevSecOps Image Signing

Click Key to use an existing key from your Secret Provider.



* Provider: The Secret Provider, which stores your GPG Key. It can be a Key Protect Instance, Secret Manager Instance, or Hashicorp Vault Instance.
* Resource Group: Resource Group that the Secrets Manager Provider belongs.
* Secret name: Name or alias of the secret, that is, GPG Key.







 DevOps Insights 

[IBM Cloud DevOps Insights](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-di_working) is included in the created toolchain and after each compliance check evidence is published into it. You do not need to provide any configuration steps for DevOps Insights, the CI pipeline automatically uses the insights instance that is included in the toolchain. DevOps Insights aggregates code, test, build, and deployment data to provide visibility into the velocity and quality of all your teams and releases.





 Optional tools 



 Slack 

If you want to receive notifications about your PR/CI Pipeline events, you can configure the Slack Tool during the setup from the toolchain template, or you can add the Slack Tool later.

In order for a Slack channel to receive notifications from your tools, you need a Slack webhook URL. To get a webhook URL, see the Incoming Webhooks section of the [Slack API website](https://api.slack.com/messaging/webhooks).

Zoom

!
IBM Cloud File Storage for Classic plug-in and monitor 384 385 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971) and [CVE-2020-24659](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24659). 
 Key Management Service provider v2.2.2 v2.2.3 Fixed bug to ignore conflict errors during KMS secret re-encryption. Updated to use Go version 1.15.5. Updated image to implement additional IBM security controls and for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1004 1078 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 
 Red Hat OpenShift Control Plane Operator v4.4.0-20201210 v4.4.0-20210112 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.4.0+20210112). 
 OpenVPN Operator image v1.0.12 v1.1.0 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 
 Red Hat OpenShift on IBM Cloud toolkit 4.4.0+20201210 4.4.0+20210112 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.4.0+20210112).
RA-5 (5) - Privileged Access 



  Control requirements 

RA-5 (5) - 0
:   The information system implements privileged access authorization to [IBM Assignment: operating systems, databases, container images, and web applications] for selected [IBM Assignment: vulnerability scans].





  NIST supplemental guidance 

In certain situations, the nature of the vulnerability scanning may be more intrusive or the information system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates more thorough vulnerability scanning and also protects the sensitive nature of such scanning.
Encryption service instance For an encrypted image, select the specific instance of the key management service where your CRK that wraps your encryption passphrase is stored. For more information, see [Setting up your key management service and keys](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-imagekms-prereqs). 
 Key name Select the customer root key (CRK) that you used to wrap your encryption passphrase. For more information, see [Setting up your key management service and keys](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-imagekms-prereqs). 
 Wrapped data encryption key For an encrypted image, specify the ciphertext that is associated with the wrapped data encryption key (WDEK). The WDEK is produced by wrapping the passphrase that you used to encrypt your image with your customer root key. For more information, see [Setting up your key management service and keys](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-imagekms-prereqs). 







 Validating an imported custom image 

After you import a custom image, you can view the checksum that was generated for the image when it is imported to IBM Cloud VPC.

If you generate a checksum locally for your image before you import it, you can compare the two checksums to make sure that they are identical. Matching checksums indicate that the image is unaltered.



1. In [IBM Cloud console](https://console.cloud.ibm.com/vpc-ext), go to Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/e9cda99c64ea1ee68cf0eda257d6a1de69ddbc4e/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Custom Images.
2.
Every IBM Maximo Application Suite Dedicated customer environment is delivered in a single tenant instance of the application, running on the Openshift platform.

All IBM Maximo Application Suite Dedicated customers use HTTPS (SSL) encryption (256 bit) at the browser level to access IBM hosted applications. Connections are SHA-2 and TLS v1.2 compatible.

IBM obtains and implements externally facing SSL certificates from a trusted Certificate Authority (CA).

All databases use native AES-256 encryption (data is encrypted at rest).

Customers will not have direct access to the operating system, file system, or web application server. Changes need to be requested through a Support ticket.

Customers will not have DBAdmin access to any database. Updates are allowed to NON-PROD databases. Updates to PROD databases need to be requested through a support ticket.





 Single Sign On 

IBM Maximo Application Suite Dedicated supports Single Sign On (SSO). Details can be found here:

[https://www.ibm.com/docs/en/mas-cd/continuous-delivery?topic=configuring-users-identity](https://www.ibm.com/docs/en/mas-cd/continuous-delivery?topic=configuring-users-identity)

LDAP and SAML (2.0) is supported.

IBM does not certify any specific tool a client has implemented within their environment. If the tool supports SAML 2.0 then it will work within the MAS MS environment.

Customers will be responsible to ensure the appropriate user setup and mapping is correct and configured.





 Penetration and Vulnerability Testing 

IBM’s Product Transformation Center (PTC) conducts penetration testing on IBM Maximo Application Suite Dedicated Service offering annually.

IBM performs external and internal vulnerability scanning and subsequent remediation in all IBM Maximo Application Suite Dedicated environments on a quarterly basis per IBM IT Security Standards (ITSS). This includes Operating System, Middleware, Application and TCP/IP vulnerability scanning.

Vulnerabilities are assigned individual vulnerability ratings and exploitation categories (Critical, High, Medium or Low). These ratings are used to determine an IBM mandated time requirement to remediate and resolve the vulnerability.