vania-janet/multiturn-rag-retrieval-data huggingface dataset:
As you plan how many Service objects you need in your cluster, keep in mind that Kubernetes uses iptables to handle networking and port forwarding rules. If you run many services in your cluster, such as 5000, performance might be impacted.







 Securing apps 

As you plan and develop your app, consider the following options to maintain a secure image, ensure that sensitive information is encrypted, and control traffic between your app pods and other pods and services in the cluster.

Image security
: To protect your app, you must protect the image and establish checks to ensure the image's integrity. Review the [image and registry security topic](https://cloud.ibm.com/docs/openshift?topic=openshift-securityimages_registry) for steps that you can take to ensure secure container images. For example, you might use Vulnerability Advisor to check the security status of container images. When you add an image to your organization's IBM Cloud Container Registry namespace, the image is automatically scanned by Vulnerability Advisor to detect security issues and potential vulnerabilities. If security issues are found, instructions are provided to help fix the reported vulnerability. To get started, see [Managing image security with Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index).

Kubernetes secrets
: When you deploy your app, don't store confidential information, such as credentials or keys, in the YAML configuration file, configmaps, or scripts. Instead, use [Kubernetes secrets](https://cloud.ibm.com/docs/openshift?topic=openshift-securitypi), such as an image pull secret for registry credentials. You can then reference these secrets in your deployment YAML file.

Secret encryption
: You can encrypt the Kubernetes secrets that you create in your cluster by using a key management service (KMS) provider.
System and Communications Protection (SC) [SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-12 Cryptographic Key Establishment and Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12) <br>[SC-12 (2) Cryptographic Key Establishment and Management | Symmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.2) <br>[SC-12 (3) Cryptographic Key Establishment and Management | Asymmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.3) <br>[SC-13 Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-13) <br>[SC-28 Protection of Information At Rest](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28) <br>[SC-28 (1) Protection of Information at Rest | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28.1) 







 6. Enable software to be run in a highly available manner 

Requirement: Design your software so that operators can meet the IBM Cloud Framework for Financial Services requirements for high availability.

Purpose & value: Operators SaaS offerings are required to be highly available so that consumers do not face downtime of critical applications.
Apply end to end security to a cloud application 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial walks you through key security services available in the IBM Cloud® catalog and how to use them together. An application that provides file sharing will put security concepts into practice.

No application architecture is complete without a clear understanding of potential security risks and how to protect against such threats. Application data is a critical resource which can not be lost, compromised or stolen. Additionally, data should be protected at rest and in transit through encryption techniques. Encrypting data at rest protects information from disclosure even when it is lost or stolen. Encrypting data in transit (e.g. over the Internet) through methods such as HTTPS, SSL, and TLS prevents eavesdropping and so called man-in-the-middle attacks.

Authenticating and authorizing users' access to specific resources is another common requirement for many applications. Different authentication schemes may need to be supported: customers and suppliers using social identities, partners from cloud-hosted directories, and employees from an organization’s identity provider.



 Objectives 



* Encrypt content in storage buckets with your own encryption keys
* Require users to authenticate before accessing an application
* Monitor and audit security-related API calls and other actions across cloud services



The tutorial features a sample application that enables groups of users to upload files to a common storage pool and to provides access to those files via shareable links. The application is written in Node.js and deployed as a container to the Kubernetes Service. It leverages several security-related services and features to improve the application's security posture.

This tutorial will work with a Kubernetes cluster running in Classic Infrastructure or VPC Infrastructure.

Zoom

!
set security vpn ipsec ike-group {{ peer_address }}_{{ ike["name"] }} proposal {{ loop.index }} encryption {{ proposal["encryption"] }}
set security vpn ipsec ike-group {{ peer_address }}_{{ ike["name"] }} proposal {{ loop.index }} hash {{ proposal["integrity"] }}

set security vpn ipsec esp-group {{ peer_address }}_{{ ipsec["name"] }} compression disable
set security vpn ipsec esp-group {{ peer_address }}_{{ ipsec["name"] }} lifetime {{ ipsec["lifetime"] }}
set security vpn ipsec esp-group {{ peer_address }}_{{ ipsec["name"] }} mode tunnel
set security vpn ipsec esp-group {{ peer_address }}_{{ ipsec["name"] }} pfs {{ ipsec["proposals"]["dhgroup"] }}

set security vpn ipsec esp-group {{ peer_address }}_{{ ipsec["name"] }} proposal {{ loop.index }} encryption {{ proposal["encryption"] }}
set security vpn ipsec esp-group {{ peer_address }}_{{ ipsec["name"] }} proposal {{ loop.index }} hash {{ proposal["integrity"] }}

set security vpn ipsec site-to-site peer {{ peer_address }} authentication mode pre-shared-secret
set security vpn ipsec site-to-site peer {{ peer_address }} authentication pre-shared-secret {{ psk }}
set security vpn ipsec site-to-site peer {{ peer_address }} ike-group {{ peer_address }}_{{ ike["name"] }}
SA-4 (2) - Design / Implementation Information for Security Controls 



  Control requirements 

SA-4 (2) - 0
:   The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [Assignment: organization-defined design/implementation information] ] at [Assignment: organization-defined level of detail].





  NIST supplemental guidance 

Organizations may require different levels of detail in design and implementation documentation for security controls employed in organizational information systems, system components, or information system services based on mission/business requirements, requirements for trustworthiness/resiliency, and requirements for analysis and testing. Information systems can be partitioned into multiple subsystems. Each subsystem within the system can contain one or more modules. The high-level design for the system is expressed in terms of multiple subsystems and the interfaces between subsystems providing security-relevant functionality. The low-level design for the system is expressed in terms of modules with particular emphasis on software and firmware (but not excluding hardware) and the interfaces between modules providing security-relevant functionality. Source code and hardware schematics are typically referred to as the implementation representation of the information system.
IBM Cloud offers many different services that you can use with your server including, Evault, SNMP and Nagios monitoring. These services require that IBM's internal systems communicate with your server to some degree. The disabled ports you see in the Exceptions list are ports open on the internal network port only. They are still blocked on the public (internet) network connection. Since the internal network is a secured network, having these ports open is considered secure.

These ports generally cannot be modified; however, if you reset the firewall rules, the ports are cleared from the Exceptions list. Be aware that resetting the firewall rules can have an adverse effect on these additional services and can cause other issues as well depending on your server configuration.





 What IP ranges do I allow through the firewall? 

For the list of IP addresses and IP ranges to allow through the firewall, go [here](https://cloud.ibm.com/docs/hardware-firewall-shared?topic=hardware-firewall-shared-ibm-cloud-ip-ranges).





 What is the maximum number of servers that the FortiGate Security Appliance 1 Gbps will protect? 

The FortiGate Security Appliance 1 Gbps can protect every server on a Public VLAN. However it is important to note that since these firewall devices are connected with 2 Gbps Uplink, IBM recommends scaling the number of firewall instances to meet the performance needs of your application. You can do so by deploying extra public VLAN Firewalls within a pod to allow for additional firewall and associated compute resources to be added.





 What VPN options are included with each Firewall product? 

Not all firewalls offer VPN and not all VPN options are the same. The general options for VPN are:



* Each customer receives unlimited SSL VPN connections to IBM's private network. These connections can be established by clicking the VPN link at the top of the page while logged in to the Cloud Catalog console.
* IBM Cloud also offers a basic multi-tenant IPsec VPN service.
* The FortiGate Security Appliance 1 Gbps provides SSL and IPsec VPN options with Public network access only (no access to the IBM Cloud private network).
Most Relevant Control Groups or Controls:



Table 4. Related controls for data encryption

 Family Control 

 System and Communications Protection (SC) [SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-12 Cryptographic Key Establishment and Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12) <br>[SC-12 (2) Cryptographic Key Establishment and Management | Symmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.2) <br>[SC-12 (3) Cryptographic Key Establishment and Management | Asymmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.3) <br>[SC-13 Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-13) <br>[SC-28 Protection of Information At Rest](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28) <br>[SC-28 (1) Protection of Information at Rest | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28.1) 







 6. Enable software to be run in a highly available manner 

Requirement: Design your software so that operators can meet the IBM Cloud Framework for Financial Services requirements for high availability.
Protecting sensitive information in your cluster 

Protect sensitive information in your IBM Cloud® Kubernetes Service cluster to ensure data integrity and to prevent your data from being exposed to unauthorized users.

For more information about securing your cluster and personal information, see [Security for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-securitysecurity) and [Storing personal information](https://cloud.ibm.com/docs/containers?topic=containers-securitypi).



 Overview of cluster encryption 

The following image and description outline default and optional data encryption for IBM Cloud Kubernetes Service clusters.

Zoom

![Overview of cluster encryption, as described in the following sections.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_encrypt_ov_kms-vpc.png)

Figure 1. Overview of cluster encryption



1. Kubernetes master control plane: Components in the Kubernetes master boot up on a LUKS-encrypted drive using an IBM-managed key. The etcd component of the master stores the configuration files of your Kubernetes resources, such as deployments and secrets. Data in etcd is stored on the local disk of the Kubernetes master and is backed up to IBM Cloud Object Storage. Data is encrypted during transit to IBM Cloud Object Storage and at rest.
2. Bring your own key (BYOK): When you [enable a key management service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) for your cluster, you bring your own root key. The root key is used to encrypt the data encryption keys (DEKs) which are then used to encrypt the secrets in your cluster. The root key is stored in the KMS provider instance that you control.
Enabling drive security by using Avago SafeStore Encryption Services 

Setting up drive security helps prevent access to stored data on removed disks without a security key. The drive data can't be recovered without this key. IBM Cloud® provides Self-Encrypting Drives (SED) at select data centers for the drives that can be bought on a Bare metal server. 10 TB SATA drives are available in our US data centers.



 Prerequisites 



* Bare metal server with SED Drives – 10 TB SATA
* Broadcom/AVAGO MegaRAID SAS 9361 -8i or Similar Broadcom/AVAGO RAID cards
* Installed Mega RAID Storage Manager Software







 Enabling drive security by using MegaRAID Storage Manager (MSM) 

Use can set the security key and safe guard data in a removed disk by using the MegaRAID Storage Manager. You can also use the WebBIOS interface that requires a security key at server start time to enter the MegaRAID card BIOS to configure the drive security setting. For more information about MegaRAID Controller Card SAS 9361-8i, see the Broadcom [MegaRAID SAS 9361-8i](https://www.broadcom.com/products/storage/raid-controllers/megaraid-sas-9361-8idocumentation).



 Identifying preinstalled SED drives 

MegaRAID Storage Manager comes preinstalled on most supported operating systems. If they are not present, you can manually install it from theBroadcom site. For more information, see [MegaRAID SAS 9361-8i downloads](https://www.broadcom.com/products/storage/raid-controllers/megaraid-sas-9361-8idownloads).

You can open MegaRAID Storage Manager by using the system credentials. In the example, a Windows environment is used and MSM is preinstalled.

When you start MSM, you must enter User name and Password which is the privileged user (Administrator) and password.

Click the Physical tab and click the drives that are available on the system. The Properties pane has the Drive Security Properties section that includes Full Disk Encryption capable field, which shows Yes.
AC-6 (1) - Authorize Access to Security Functions 



  Control requirements 

AC-6 (1) - 0
:   The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].





  NIST supplemental guidance 

Security functions include, for example, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. Explicitly authorized personnel include, for example, security administrators, system and network administrators, system security officers, system maintenance personnel, system programmers, and other privileged users.
Security 



 Client Security Concerns 

Should a customer suspect a Cyber Security issue with their system, client should open a Severity 1 case containing as much detail as possible.





 Client Security Questionnaires 

Before submitting questionnaires, IBMers and clients should first refer to the security information, links and certifications that are available on this page. Existing customers who need a security questionnaire or assessment completed should submit a case to the IBM Support Community Portal and attach the document or link. This will be routed to the proper SRE security resource for review / completion. Please note there is a 2-3 week turnaround time required for the SRE security team to respond to client provided security forms or questionnaires; additional time may also be required for Watson IoT Security team review.

Although IBM will fill out security questionairres as above, client led audit of the MAS Dedicated offering is not supported or allowed. This includes onsite audit visits or performing validation tasks for individual clients. IBM will provide certifications as below only.





 Security Management 

IBM maintains and follows standard mandatory employment verification requirements for all hires. In accordance with IBM internal process and procedures, these requirements are periodically reviewed and include, but may not be limited to, criminal background check, proof of identity validation, and additional checks as deemed necessary by IBM.



* All IBMers are required to complete mandatory Cyber Security & Privacy training annually
* All IBMers are required to complete GDPR training annually
* All IBMers are required to complete mandatory Business Conduct Guidelines training annually
* Only IBM Maximo Application Suite Dedicated Service personnel are permitted access to customer systems
* IBM Maximo Application Suite Dedicated Service personnel are required to use privileged access workstations to connect and work with our customer's IBM systems. These workstations meet IBM's highest and most stringent security guidelines.



IBM Maximo Application Suite Dedicated Service personnel who are granted O/S or console level access to customer servers are required to use multi-factor authentication. Unique 2048-bit ssh keys are issued to each IBM user in order to connect to the IBM Cloud VPN. Phone based authentication via PIN is also required each time an IBMer connects. These factoring mechanisms are maintained, managed and issued by IBM Cloud Security and the IBM Maximo Application Suite Dedicated Environment Operations Manager.
* [Compliance monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for CA-7 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 CA-7 (d) <br><br> * Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s)<br> * Check that Activity Tracker Event Routing is configured to collect global events generated by IBM Cloud services<br><br><br> 







 NIST supplemental guidance 

Continuous monitoring programs facilitate ongoing awareness of threats, vulnerabilities, and information security to support organizational risk management decisions. The terms continuous and ongoing imply that organizations assess/analyze security controls and information security-related risks at a frequency sufficient to support organizational risk-based decisions. The results of continuous monitoring programs generate appropriate risk response actions by organizations. Continuous monitoring programs also allow organizations to maintain the security authorizations of information systems and common controls over time in highly dynamic environments of operation with changing mission/business needs, threats, vulnerabilities, and technologies. Having access to security-related information on a continuing basis through reports/dashboards gives organizational officials the capability to make more effective and timely risk management decisions, including ongoing security authorization decisions. Automation supports more frequent updates to security authorization packages, hardware/software/firmware inventories, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Continuous monitoring activities are scaled in accordance with the security categories of information systems.
eu-de Yes Yes Yes (see note) Yes Yes Yes eu-de Yes Yes eu-de Yes Yes 
 us-south Yes Yes Yes (see note) Yes Yes Yes us-south Yes Yes us-south Yes Yes 
 us-east Yes Yes Yes (see note) Yes Yes Yes us-east Yes Yes us-east Yes Yes 
 ca-tor No Yes Yes (see note) Yes Yes Yes ca-tor Yes Yes ca-tor Yes Yes 
 br-sao No Yes Yes (see note) Yes Yes Yes br-sao Yes Yes br-sao Yes Yes 
 eu-es No Yes No Yes Yes Yes eu-de No Yes eu-de Yes Yes 



It is possible to create a bucket and associate any available Key Protect or Hyper Protect Crypto Services instance with any of the listed Cloud Object Storage locations. Hyper Protect Crypto Services is only available in selected locations and it is your responsibility to ensure the location/region you select meets any pertinent requirements. Please refer to [Hyper Protect Crypto Services documentation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions) and [IBM Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about) for a list of regions/locations currently available.





 Single Data Centers 



 Region Aspera Key Protect Hyper Protect Crypto Services Archive Data Object Lock Immutable Object Storage Activity Tracker Functions Smart Tier Monitoring Replication One Rate 

 ams03 No No No No No No eu-de No Yes eu-de Yes Yes 
 che01 No No No No No No ap-tok No Yes ap-tok Yes Yes 
 mil01 No No No No No No eu-de No Yes eu-de Yes Yes 
 mon01 No No No No No No us-south No Yes us-south Yes Yes 
 par01 No No No No No No eu-de No Yes eu-de Yes Yes 
 sjc01 No No No No No No us-south No Yes us-south Yes Yes 
 sng01 No No No No No No ap-tok No Yes ap-tok Yes Yes 







 Satellite