vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Information technology products for which security-related configuration settings can be defined include, for example, mainframe computers, servers (e.g., database, electronic mail, authentication, web, proxy, file, domain name), workstations, input/output devices (e.g., scanners, copiers, and printers), network components (e.g., firewalls, routers, gateways, voice and data switches, wireless access points, network appliances, sensors), operating systems, middleware, and applications. Security-related parameters are those parameters impacting the security state of information systems including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: (i) registry settings; (ii) account, file, directory permission settings; and (iii) settings for functions, ports, protocols, services, and remote connections. Organizations establish organization-wide configuration settings and subsequently derive specific settings for information systems. The established settings become part of the systems configuration baseline. Common secure configurations (also referred to as security configuration checklists, lockdown and hardening guides, security reference guides, security technical implementation guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for specific information technology platforms/products and instructions for configuring those information system components to meet operational requirements. Common secure configurations can be developed by a variety of organizations including, for example, information technology product developers, manufacturers, vendors, consortia, academia, industry, federal agencies, and other organizations in the public and private sectors. Common secure configurations include the United States Government Configuration Baseline (USGCB) which affects the implementation of CM-6 and other controls such as AC-19 and CM-7. The Security Content Automation Protocol (SCAP) and the defined standards within the protocol (e.g., Common Configuration Enumeration) provide an effective method to uniquely identify, track, and control configuration settings. OMB establishes federal policy on configuration requirements for federal information systems.
Security 

A summary of the Security policies and processes for TRIRIGA Application Suite Managed Services.



 Client Security Concerns 



* Should a customer suspect a Cyber Security issue with their system, client should open a Severity 1 case containing as much detail as possible.







 Client Security Questionnaires 



* Before submitting questionnaires, IBMers and clients should first refer to the security information, links and certifications that are available on this page.
* Existing customers who need a security questionnaire or assessment completed should submit a case to the IBM Support Community Portal and attach the document or link. This will be routed to the proper CDS security resource for review / completion.
* Please note there is a 2-3 week turnaround time required for the CDS security team to respond to client provided security forms or questionnaires; additional time may also be required for Watson IoT Security team review







 Security Management 



* IBM maintains and follows standard mandatory employment verification requirements for all hires. In accordance with IBM internal process and procedures, these requirements are periodically reviewed and include, but may not be limited to, criminal background check, proof of identity validation, and additional checks as deemed necessary by IBM.
* All IBMers are required to complete mandatory Cyber Security & Privacy training annually
* All IBMers are required to complete GDPR training annually
* All IBMers are required to complete mandatory Business Conduct Guidelines training annually
* Only IBM TRIRIGA Application Suite Managed Service personnel are permitted access to customer systems
* IBM TRIRIGA Application Suite Managed Service personnel are required to use privileged access workstations to connect and work with our customer's IBM systems. These workstations meet IBM's highest and most stringent security guidelines.
* IBM TRIRIGA Application Suite Managed Service personnel who are granted O/S or console level access to customer servers are required to use multi-factor authentication. Unique 2048-bit ssh keys are issued to each IBM user in order to connect to the IBM Cloud VPN. Phone based authentication via PIN is also required each time an IBMer connects. These factoring mechanisms are maintained, managed and issued by IBM Cloud Security and the IBM TRIRIGA Application Suite Managed Service Environment Operations Manager.
* IBM's internal network prevents employees from accessing malicious websites using Symantec Bluecoat and ProofPoint Targeted Attack Protection (TAP)
You should ensure your underlying physical storage is encrypted using keys managed by an on-premises FIPS 140-2 level 2 or higher hardware security module (HSM).





 Integrating Hyper Protect Crypto Services with other IBM Cloud services 

You must integrate Hyper Protect Crypto Services with the IBM Cloud services that are part of your reference architecture deployments. Block Storage for VPC and Object Storage can be the most obvious services that need to have data encrypted at rest. But, other services have data that needs to be encrypted as well.

The following table provides references for requirements that are related to encryption of data at rest for each service in the reference architecture. See also [Integrating IBM Cloud services with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services) for more details.



Table 1. Data encryption information for IBM Cloud services in the reference architectures

 Category VPC reference architecture Satellite reference architecture Optional for both 

 Core <br><br> * [VPC infrastructure services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-about)[1]<br><br><br> <br><br> * [Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-data-securitysat-data-encryption)<br><br><br>
Important best practices with security implications are addressed across this handbook:



* [Authentication](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-authentication)
* [Authorization](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-authorization)
* [Encryption](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-encryption)
* [Robustness](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-robustness)
* Validation for [formats](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-format), [parameters](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-urisquery-parameters), and [types](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-types)
The security engineering principles in SA-8 cannot be properly applied if individuals that design, code, and test information systems and system components (including information technology products) do not understand security. Therefore, organizations include qualified personnel, for example, chief information security officers, security architects, security engineers, and information system security officers in system development life cycle activities to ensure that security requirements are incorporated into organizational information systems. It is equally important that developers include individuals on the development team that possess the requisite security expertise and skills to ensure that needed security capabilities are effectively integrated into the information system. Security awareness and training programs can help ensure that individuals having key security roles and responsibilities have the appropriate experience, skills, and expertise to conduct assigned system development life cycle activities. The effective integration of security requirements into enterprise architecture also helps to ensure that important security considerations are addressed early in the system development life cycle and that those considerations are directly related to the organizational mission/business processes. This process also facilitates the integration of the information security architecture into the enterprise architecture, consistent with organizational risk management and information security strategies.
Data security and compliance 

IBM® Key Protect for IBM Cloud® has data security strategies in place to meet your compliance needs and ensure that your data remains secure and protected in the cloud.



 Secrets management 

Secrets required for deployment are managed with automation using a HashiCorp Vault and are not stored in charts, GitHub, or deployment scripts.





 Security readiness 

Key Protect ensures security readiness by adhering to IBM best practices for systems, networking, and secure engineering.

To learn more about security controls across IBM Cloud, see [How do I know that my data is safe?](https://cloud.ibm.com/docs/overview?topic=overview-securitysecurity).



 Data encryption 

Key Protect uses [IBM Cloud hardware security modules (HSMs)](https://ibm.com/cloud/hardware-security-module) to generate provider-managed key material and perform [envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption) operations. HSMs are tamper-resistant hardware devices that store and use cryptographic key material without exposing keys outside of a cryptographic boundary.

Access to Key Protect takes place over HTTPS and uses Transport Layer Security (TLS) to encrypt data in transit.

Note that only the following TLS 1.2 and TLS 1.3 ciphers are supported:



* TLS 1.2:



* ECDHE-ECDSA-AES128-GCM-SHA256
* ECDHE-ECDSA-AES256-GCM-SHA384
* ECDHE-RSA-AES128-GCM-SHA256
* ECDHE-RSA-AES256-GCM-SHA384
* ECDHE-ECDSA-AES128-SHA256
* ECDHE-ECDSA-AES256-SHA384
* ECDHE-RSA-AES128-SHA256
* ECDHE-RSA-AES256-SHA384



* TLS 1.3:



* TLS_AES_256_GCM_SHA384
Security for IBM Cloud Kubernetes Service 

You can use built-in security features in IBM Cloud® Kubernetes Service for risk analysis and security protection. These features help you to protect your cluster infrastructure and network communication, isolate your compute resources, and ensure security compliance across your infrastructure components and container deployments.

For an analysis of security guidelines by product version, see [CIS Kubernetes Benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark).



 Overview of security threats for your cluster 

To protect your cluster from being compromised, you must understand potential security threats for your cluster and what you can do to reduce the exposure to vulnerabilities.

External attacks
: Attackers that gain access to your cluster, deployed resources, apps, or personal information.

Vulnerable deployments
: Known vulnerabilities are exploited to gain access to the cloud environment and run malicious software.

Compromised or lost data
: Incorrect storage of sensitive data and missing encryption.

Insiders and third party vendors
: Missing network isolation and segmentation can lead to the misuse of legitimate permissions.

Cloud security and the protection of your systems, infrastructure, and data against attacks became very important over the last couple of years as companies continue to move their workloads into the public cloud. A cluster consists of several components that each can put your environment at risk for malicious attacks. To protect your cluster against these security threats, you must make sure that you apply the latest IBM Cloud Kubernetes Service and Kubernetes security features and updates in all cluster components.

These components include:



* [Kubernetes API server and etcd data store](https://cloud.ibm.com/docs/containers?topic=containers-securityapiserver)
* [Worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-securityworkernodes)
* [Network](https://cloud.ibm.com/docs/containers?topic=containers-securitynetwork)
* [Persistent storage](https://cloud.ibm.com/docs/containers?topic=containers-securitystorage)
AU-9 - Protection of Audit Information 



  Control requirements 

AU-9 - 0
:   The information system protects audit information and audit tools from unauthorized access, modification, and deletion.





  NIST supplemental guidance 

Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This control focuses on technical protection of audit information. Physical protection of audit information is addressed by media protection controls and physical and environmental protection controls.
AC-4 (4) - Content Check Encrypted Information 



  Control requirements 

AC-4 (4) - 0
:   The information system prevents encrypted information from bypassing content-checking mechanisms by [Selection (one or more): decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [Assignment: organization-defined procedure or method] ].





  Additional IBM Cloud for Financial Services specifications 



*  This control is required for ISVs.
When an event occurs, a message with or without the event payload is then sent out and could be directly reacted upon.





 Control encryption keys 

Almost all services on IBM Cloud that store data use encryption to protect the data against unauthorized access. When using database services or Object Storage, by default the encryption key is system-generated. You can increase data protection by controlling the encryption keys. IBM Key Protect and Hyper Protect Crypto Services help you provision encrypted keys for storage services as well as apps. Both services are based on [Hardware Security Modules](https://en.wikipedia.org/wiki/Hardware_security_module) (HSM) to manage and safeguard the encryption keys. IBM Key Protect allows to bring your own key (BYOK), Hyper Protect Crypto Services even support KYOK (Keep Your Own Key). When importing your own keys, make sure to [utilize an import token for increased security](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keys). Note that you can [organize your keys in key rings](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). By applying access policies based on key rings you achieve more fine granular access control and higher security.



 Integrated services 

Many data services support the integration with either Key Protect or Hyper Protect Crypto Services. To see if they can be used with the services in your deployed solution, check out the list of:



* [integrated services for Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services) and the
* [integrated services for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services).



Supported services include Object Storage, Block Storage for VPC, IBM Cloudant, IBM Db2 on Cloud, Kubernetes Service, IBM Cloud® Virtual Servers for Virtual Private Cloud and more.
[IBM Cloud® Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-overview) offers highly secure database environments that have technology-enforced protection and high availability.

Built on IBM LinuxONE technology, Hyper Protect DBaaS for MongoDB helps you to alleviate data security and compliance concerns with built-in encryption and tamper protection for data at rest and in flight. You can deploy your workloads with sensitive data and build compliant applications without having to be a security expert.





 IBM Cloud Hyper Protect DBaaS for PostgreSQL (optional) 

Moving confidential and mission-critical data to the cloud presents data confidentiality, security, and reliability concerns. [IBM Cloud® Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-overview) offers highly secure database environments that have technology-enforced protection and high availability.

Built on IBM LinuxONE technology, Hyper Protect DBaaS for PostgreSQL helps you to alleviate data security and compliance concerns with built-in encryption and tamper protection for data at rest and in flight. You can deploy your workloads with sensitive data and build compliant applications without having to be a security expert.









 Satellite components in IBM Cloud 

When you provision the Satellite service, the Satellite control plane master is created in your account. The following table describes the main components of the control plane master.



Table 3. Overview of Satellite control plane master components
Overview of the Satellite control plane master components

 Master components Description 

 Satellite Link tunnel The Satellite Link tunnel server creates a secure TLS connection to the Satellite Link connector that runs on the control plane worker nodes in your Satellite location. Three tunnels are created between the tunnel server and the connector to support redundancy across the three availability zones of your location. All communication that leaves and enters your location is proxied by the Link tunnel server, and the connection metadata that is captured and monitored by IBM to detect malicious activity.
How does Security and Compliance Center work? 

When you work with IBM Cloud® Security and Compliance Center, you interact with several different entities and can take multiple user paths through the service. Learn more about each entity by reviewing the following definitions and user flows.



 Terminology 

Control
: A technical, administrative, or physical safeguard that is designed to meet a set of defined security and privacy requirements. Controls exist to prevent, detect, or lessen the ability of a threat to exploit a vulnerability.

Control library
: A collection of predefined or custom controls. Control libraries show all the controls in your accounts that are available to be evaluated. A library is helpful for organizing and versioning of your controls. A library is structured as follows.

Zoom

![The diagram shows the layout of a control library. The information is conveyed in the surrounding text.](https://cloud.ibm.com/docs-content/v1/content/a6478671e8f845a84102d9cf49bf28ee7f4f3227/security-compliance/images/control-library.svg)

Figure 1. Understanding control libraries

Profile
: A group of controls that are related to a specific compliance objective.

Although very similar in structure to a control library, a profile can be attached to a set of resources and be evaluated. When you create the attachment, you can set the parameters that define the way that the evaluation is done.

Zoom

![The diagram shows the layout of a profile. The information is conveyed in the surrounding text.](https://cloud.ibm.com/docs-content/v1/content/a6478671e8f845a84102d9cf49bf28ee7f4f3227/security-compliance/images/kc-profile.svg)

Figure 2. Understanding profiles in the new architecture

Specification
: A statement that defines the specific security and privacy requirements that a control must meet. For example, Check whether App ID Cloud Directory users aren't able to update their own accounts.

Assessment
* API keys
* Long-lived authentication tokens (OAuth2, github, IAM, etc.)
* SSH keys
* Encryption keys
* Other private keys (PKI/TLS certificates, HMAC keys, signing keys, etc.)



You should should ensure:



* Secrets are generated and stored in the environment (e.g., dev, test, production) where your service is deployed.
* Secrets never leave their environments (e.g., dev, test, production) and should be secured using access control measures. Service design should minimize the number of machines and people with access to secrets using both authorization and network restrictions based on the principle of least privilege.
* Secrets are rotated in according with the requirements of the IBM Cloud Framework for Financial Services with minimal or no down time.
* Secrets are never stored in source code, configuration files, or documentation.



Implementation guidance:



* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secrets)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secrets)



Most Relevant Controls:



Table 16. Related controls for secrets management

 Family Control 

 Access Control (AC) [AC-2 Account Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-2) 
 Identification and Authentication (IA) [IA-2 User Identification and Authentication](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2) <br>[IA-3 Device Identification and Authentication](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-3) <br>[IA-5 Authenticator Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5)
Security considerations for initializing a service instance 

When you initialize your IBM Cloud® Hyper Protect Crypto Services instance, you need to make decisions that affect the security of your instance.



 Considerations for storing signature keys and master key parts 

You need to decide the following aspects:



* Are you going to use smart cards to store signature keys and master key parts, or use files?
* If you use key part files and signature key files, are you going to use recovery crypto units to generate a random master key value and hold the backup copy of the master key?
* How many signatures are required for sensitive commands?
* How many key parts are you going to use to load the master key registers?
* How often are you going to change the master key value?



Using smart cards to store signature keys and master key parts is more secure than using files. When a signature key is stored on a smart card, it never appears in the clear outside the smart card. When a master key part is stored on a smart card, it never appears in the clear outside the smart card or a crypto unit.

When a signature key or master key part is stored in a file, the key or key part is decrypted and appears temporarily in the clear in workstation memory when it is used.

When recovery crypto units are used to generate a random master key value and hold the backup copy of the master key, the master key value never appears in the clear outside an IBM crypto unit.





 Considerations for defining the Management Utilities security policy 

If you decide to use smart cards, you need to consider the following aspects:



* How many backup copies of your smart cards are you going to make? You should make at least one backup copy of all smart cards and store them in a secure place.
* Where are you going to store smart cards when they are not in use?
* Who needs to know the smart card PINs?



Some organizations store their smart cards in a safe, and keep a log of when the smart cards are used for administrative actions and who used them.





 Considerations for defining the file security policy 

If you decide to use key part files and signature key files, you also need to consider the following aspects:



* Where are you going to save backup copies of the files?