vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Securing your data in VMware as a Service 

To ensure that you can securely manage your data when you use IBM Cloud® for VMware as a Service, it is important to know exactly what data is stored and encrypted and how you can delete any stored data. All VMware as a Service instances come with encryption enabled that uses a unique cloud provider key per instance. Each VMware as a Service instance is configured with the following unique resources:



* Dedicated Key Protect instance
* Dedicated keys per instance
* Dedicated KMIP™ adapter per instance





 How your data is stored and encrypted in VMware as a Service 

The VMware as a Service data plane consists of the following types of data:



* Customer VMware as a Service instance metadata
* Customer data



All data types and all solution data are regionally isolated. For each region that is supported by the VMware as a Service offering, all runtime data is maintained within region. The exception is backup data, which is isolated inside the regions geo-political boundaries for data resiliency if a full region disaster occurs.





 Protecting your sensitive data in VMware as a Service 



 Customer VMware as a Service instance metadata 

This data is client metadata that is associated with the created VMware as a Service instance.

VMware as a Service is public in that the same service is supporting many different customers. As instances are created, modified, and deleted by customers, metadata about each customer instance is maintained by the service. The instance metadata describes the details of the VMware as a Service instances.

Some of the metadata is collected directly from the customer and other metadata is generated as an artifact of the automation logic that is used to order and configure the instance such as the hosts, storage, networking, and service data. Instance metadata includes:



* Client cloud account and contact information
* Instance names and IDs of VMware® instances that are deployed for customers
* VMware instances locations
* Installed services, for example, Veeam®, Zerto, or HCX™
* Deployment state of each instance, for example Deploying, Failed, or Ready
AC-6 (10) - Prohibit Non-privileged Users from Executing Privileged Functions 



  Control requirements 

AC-6 (10) - 0
:   The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.





  NIST supplemental guidance 

Privileged functions include, for example, establishing information system accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.
"policy_data": {
"enabled": false
}
}
]
}'

Replace the variables in the example request according to the following table.



Table 2. Describes the variables needed to disable the key create and import access policy

 Variable Description 

 region Required. The region abbreviation, such as us-south, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 



A successful request returns an HTTP 204 No Content response, which indicates that the key create and import access policy is updated for your service instance.
3. Optional: Verify that the key create and import access policy is disabled by retrieving the policy details for your Hyper Protect Crypto Services instance.

$ curl -X GET "https://api.<region>.hs-crypto.cloud.ibm.com/api/v2/instance/policies?policy=keyCreateImportAccess"   -H "accept: application/vnd.ibm.kms.policy+json"   -H "authorization: Bearer <IAM_token>"   -H "bluemix-instance: <instance_ID>"
* For a tutorial on how to use TDE with Hyper Protect Crypto Services, see

[Tutorial: Using Oracle Transparent Database Encryption with Hyper Protect Crypto Services PKCS #11](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-tde-pkcs11).
* For a tutorial on how to use Db2 default encryption with Hyper Protect Crypto Services, see

[Using IBM Db2 default encryption with Hyper Protect Crypto Services PKCS #11](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-db2-pkcs11).







 Protecting data in transit with TLS/SSL offloading 

Transport Layer Security (TLS) and Secure Sockets Layer (SSL) are cryptographic protocols that are designed to provide communication security over a computer network. The TLS/SSL protocol aims primarily to provide privacy and data integrity between two or more communicating computer applications.

In the context of web servers, the TLS/SSL protocol allows a website to establish the identity. Users of the website can be sure that no one else is masquerading as the website. It is done through a public-private key pair.

Hyper Protect Crypto Services provides a way to offload the cryptographic operations that are done during the TLS handshake to establish a secure connection to the web server, while it keeps the TLS/SSL private key securely stored in the dedicated HSM. In this way, you have control over your TLS/SSL keys and processing. As a result, security is improved and reputational risk is decreased.

TLS/SSL offloading to the Hyper Protect Crypto Services HSM enables data in transit protection for web, API, and mobile transactions by using the standard PKCS #11 API. With Hyper Protect Crypto Services, you can integrate TLS/SSL offloading with other cloud proxies.
Encryption in transit for your file shares lets you establish an encrypted mount connection between the virtual server instance and storage system using the Internet Security Protocol (IPsec) security profile. For more information, see [Enabling file share encryption in transit secure connections](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit).





 Is there support for security groups and network ACLs? 

Yes. You can specify a security group access control mode to restrict mounting file shares to specific instances in your VPC. For more information, see [Granular authentication](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-aboutfs-mount-access-mode).





 How is my data protected in a file share? Can I use my own encryption keys? 

By default, your file share data is protected at rest with IBM-managed encryption. You can also bring your own keys to the IBM Cloud® and use them to encrypt your file shares. For more information, see [Creating file shares with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption). By using the API, you can link a primary account that holds a root key to a secondary account, then use that key to encrypt new file shares in the secondary account. For more information, see [Cross-account encryption for multitenant storage resources](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).





 Is my data protected during transit? 

You can enable secure end-to-end encryption of your data when you use file shares with security-group-based access control mode and mount targets with virtual network interfaces. When such a mount target is attached and the share is mounted on a virtual server instance, the virtual network interface performs security group policy check to ensure only authorized instances can communicate with the share. The traffic between the authorized virtual server instance and the file share can be IPsec encapsulated by the client.
Viewing associations between root keys and encrypted IBM Cloud resources 

You can view associations between root keys and other cloud resources, such as Cloud Object Storage buckets or Cloud Databases deployments, by using the IBM Key Protect API.

When you use a root key to protect at rest data with envelope encryption, the cloud services that use the key can create a registration between the key and the resource that it protects.

Registrations are associations between keys and cloud resources that help you get a full view of which encryption keys protect what data on IBM Cloud.



Table 1. Describes the benefits of key registration.

 Benefit Description 

 Centralized view of protected resources As an administrator for your Key Protect instance, you want to quickly understand which cloud resources are protected by a root key. 
 Security and compliance As a security admin, you need a way to determine the risk that's involved with [destroying a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys). <br>You want to examine which keys are actively protecting what data so that you can evaluate exposures based on your organization's security or compliance needs. 



Key registration is an extra feature that's available only if the cloud service has enabled it as part of its integration with Key Protect. To determine whether an [integrated service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services) supports key registration, refer to its service documentation for more information.



 Viewing protected resources in the console 

You can browse the registrations that are available between your Key Protect keys and cloud resources by using the Key Protect IBM Cloud console.



 Viewing protected resources in your instance 



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. Select the Associated resources link on the left side menu.
5. On the Associated resources page, use the Associated Resources table to browse the registrations in your service.
6.
Updated By user id ...<redacted>...
Policy Type allowedNetwork
Enabled true
Network Allowed public-and-private

 disable the instance allowed-network policy
$ ibmcloud kp instance policy-update allowed-network --disable

Updating instance policy...
OK

 list the instance policies - the policy exists and it's disabled
$ ibmcloud kp instance policies

Retrieving policy details for instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Created By user id ...<redacted>...
Creation Date 2020-06-22T16:17:52Z
Last Updated 2020-06-22T16:20:08Z
Updated By user id ...<redacted>...
Policy Type allowedNetwork
Enabled false
Network Allowed public-and-private

 list the instance policies and show the output as JSON
$ ibmcloud kp instance policies --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T16:17:52Z",
"lastUpdated": "2020-06-22T16:20:08Z",
"updatedBy": "user id ...<redacted>...",
"policy_type": "allowedNetwork",
"policy_data": {
"enabled": false,
"attributes": {
"allowed_network": "public-and-private"
}
}
}
]





 Required parameters 

-i, --instance-ID
: The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command.

$ export KP_INSTANCE_ID=INSTANCE_ID





 Optional parameters 

-a, --allowed-network
SC-28 (1) - Cryptographic Protection 



 Control requirements 

SC-28 (1) - 0
: The information system implements cryptographic mechanisms to prevent unauthorized disclosure and modification of [IBM Assignment: confidential customer data] on [IBM Assignment: organization-defined information system components including portable computers, mobile devices, and electronic removable media].





 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Data encryption at rest](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether OS disks are encrypted with customer-managed keys
* Check whether App ID user data is encrypted
* Check whether Hyper Protect DBaaS for MongoDB is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether unattached disks are encrypted with customer-managed keys
* Check whether Virtual Servers for VPC boot volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Virtual Servers for VPC is provisioned from an encrypted image
* Check whether Event Streams is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether App ID is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check that Schematics uses KYOK for Key management
* Check whether Block Storage for VPC is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Hyper Protect DBaaS for PostgreSQL is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Cloud Object Storage is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
SC-7 (c) <br><br> * Check whether Virtual Private Cloud (VPC) security groups have inbound ports that are open only to permitted IP addresses<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached<br> * Check whether all virtual server instances have at least one Virtual Private Cloud (VPC) security group attached<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached at the time of provisioning<br> * Check whether account has at least one VPN or Direct Link configured<br> * Check whether Virtual Private Cloud (VPC) classic access is disabled<br> * Check whether Virtual Private Cloud (VPC) has no rules in the default security group<br> * Check whether all network interfaces of a virtual server instance have at least one Virtual Private Cloud (VPC) security group attached<br> * Check whether Virtual Servers for VPC instance has the minimum # interfaces<br> * Check whether Virtual Private Cloud (VPC) has no subnet with public gateway attached<br> * Check whether Virtual Private Cloud (VPC) security groups have outbound ports that are open only to permitted IP addresses<br> * Check whether Virtual Private Cloud (VPC) is configured with public gateways that are provisionable only within permitted zones<br> * Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port<br><br><br> 







 NIST supplemental guidance 

Managed interfaces include, for example, gateways, routers, firewalls, guards, network-based malicious code analysis and virtualization systems, or encrypted tunnels implemented within a security architecture (e.g., routers protecting firewalls or application gateways residing on protected subnetworks). Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational information systems includes, for example, restricting external web traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses. Organizations consider the shared nature of commercial telecommunications services in the implementation of security controls associated with the use of such services.
"userReputation": 489,
"username": "Matthew G.",
"views": 3234
}
* How can you protect your data when using Watson Discovery?

To learn about securing your data when using Watson Discovery, refer to [Protecting sensitive information in your Watson service](https://cloud.ibm.com/docs/discovery?topic=watson-keyservice). For general information about the security architecture, review [Securing AI apps: Watson on IBM Cloud security](https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/watson-security).
* What Watson solutions are available to respond to Covid-19 questions?

[IBM Watson Assistant for Citizens](https://www.ibm.com/watson/covid-response) on the IBM public cloud brings together Watson Assistant, Natural Language Processing capabilities from IBM Research, and state-of-art enterprise AI search capabilities with Watson Discovery, to understand and respond to common questions about COVID-19. For information on what’s available with Watson Discovery, review [Using the COVID-19 kit](https://cloud.ibm.com/docs/discovery?topic=discovery-covidkit).
* Can I migrate documents from one Discovery instance to another?

You cannot migrate original documents from one instance to another. Instead, ingest the documents to the newly created instance.
* How do I delete documents from my Discovery collection?

Use the [Delete method](https://cloud.ibm.com/apidocs/discoverydelete-a-document) in the Discovery API to delete documents. There is no delete option within the user interface.



Discovery v2



* How do I search the product documentation?

To search the entire IBM Cloud Docs site, enter your search term into the search field in the IBM Cloud website banner. To search for information about the Discovery service only, scroll to the start of the page and enter your search term into the search field in the page header.

!
(https://cloud.ibm.com/docs/schematics?topic=schematics-general-data-protection-regulation-gdprhow-do-i-audit-access-to-ibm-schematics)
* [Supporting classifications of personal data](https://cloud.ibm.com/docs/schematics?topic=schematics-general-data-protection-regulation-gdprsupported-classifications-of-personal-data)
* [About user data](https://cloud.ibm.com/docs/schematics?topic=schematics-general-data-protection-regulation-gdprdata-about-me)
* [Is the Schematics database encrypted?](https://cloud.ibm.com/docs/schematics?topic=schematics-general-data-protection-regulation-gdpris-our-ibm-schematics-database-encrypted)
* [Data locations](https://cloud.ibm.com/docs/schematics?topic=schematics-general-data-protection-regulation-gdprdata-locations)
* [Service security](https://cloud.ibm.com/docs/schematics?topic=schematics-general-data-protection-regulation-gdprservice-security)
* [Deletion of data](https://cloud.ibm.com/docs/schematics?topic=schematics-general-data-protection-regulation-gdprdeletion-of-data)



[Best practices for securing the Schematics objects](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-secure-objects)



* [Best practices for creating Terraform Templates or modules in Git repositories](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-secure-repo)



* [What are the best practices that you must follow in developing the Terraform templates, and publishing the same in the Git repositories?]
Provisioning a HIPAA compliance instance 

Across every industry, organizations require tighter controls and visibility into where their data is stored and processed in the IBM Cloud®. To manage events for HIPAA resources by using the IBM Cloud Activity Tracker service, consider the following information:

HIPAA compliance is a shared responsibility. IBM only provides the security and the tools to ensure its cloud platform can be used without violating HIPAA rules. It is the responsibility of HIPAA-covered entities to ensure that cloud-based infrastructure and applications are not misconfigured, and that stored files are appropriately secured.



 Step 1. Enable the HIPAA supported settings in your account 

If you're the account owner, you can [enable your IBM Cloud® account to be HIPAA supported.](https://cloud.ibm.com/docs/account?topic=account-enabling-hipaa) You might choose to enable the HIPAA Supported setting if you plan to include Protected Health Information (PHI) in HIPAA-enabled services.

The US Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act define standards for handling electronic healthcare transactions and information. If you or your company is a covered entity as defined by HIPAA, you must enable the HIPAA Supported setting if you run sensitive workloads that are regulated under HIPAA and the HITECH Act. Learn more about IBM Cloud compliance in [Compliance on the IBM Cloud](https://www.ibm.com/cloud/compliance).

Enabling this setting has the following effects:



* Enables you to filter on HIPAA Enabled services in the catalog
* Indicates to IBM that your account stores protected health information (PHI)
* Digitally accepts the IBM Business Associate Addendum (BAA) for covered entities



Enable this setting only if you or your company is a covered entity as defined by HIPAA. If you or your company is a business associate of a covered entity, [contact IBM Cloud Sales](https://www.ibm.com/account/reg/us-en/signup?formid=MAIL-wcp) to accept the applicable BAA.
In addition, for services that store data, it is suggested that you use one or more of these tags corresponding to different kinds of data:



* audit: Audit logs or archives
* public: Publicly accessible, such as Cloud Object Storage buckets that hold public documentation or samples
* consumer-owned-data: Data owned by the consumer
* consumer-metadata: Metadata owned by the consumer
* regulated-data: Data that is regulated







 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 Access Control (AC) [AC-16 Security Attributes](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-16) 
 System and Communications Protection (SC) [SC-16 Transmission of Security Attributes](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-16) 







 Next steps 

If using the VPC reference architecture, then see:



* [VPC networking overview](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-overview)



If using the Satellite reference architecture, then see:



* [Satellite networking overview](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-connectivity-overview)