vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You and IBM share responsibilities for controlling access to your Hyper Protect Crypto Services instances and resources. You are responsible for identity and access management to your application data.



Table 3. Responsibilities for identity and access management

 Task IBM responsibilities Your responsibilities 

 User management IBM does not have access to your resources but provides you with the ability to restrict user access to resources. Depending on your needs, restrict access to resources and service functionality by using Cloud IAM access policies. For more information, see [Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access). 
 Service and key policies IBM does not have access to your resources but provides you with the ability to set service and key policies. Manage your [service instance policies](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-dual-auth) and [key policies](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policy). 
 Connecting to third-party cloud Provide error messages when access to the third-party keystores does not work. Make sure the connection information and access credentials for the third-party cloud service provider are always up to date in your Hyper Protect Crypto Services instance. 







 Security and regulation compliance 

Security and regulation compliance includes tasks such as security controls implementation and compliance certification. IBM is responsible for the security and compliance of Hyper Protect Crypto Services. You are responsible for the security and compliance of your application data.



Table 4. Responsibilities for security and regulation compliance

 Task IBM responsibilities Your responsibilities 

 Applications Maintain controls that are commensurate to [various industry compliance standards](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliancecompliance-ready). Set up and maintain security and regulation compliance for your apps and data.
You need to set the variable or output parameter as sensitive to make sure that the data is not leaked in the logs or outputs.





 How can you protect the access to workspaces and its data? 

As the account owner or an authorized account administrator, you can assign IBM Cloud® Identity and Access Management (IAM) service access roles to your users. The IAM service access roles determine the actions that you can set on an IBM Cloud Schematics resource, such as a workspace or an action. To avoid assigning access policies to individual users, consider creating [IAM access groups](https://cloud.ibm.com/docs/account?topic=account-groups).

Your workspaces and actions data store depends on the location where you create your workspace or an action. For more information, see [securing your data in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-data).





 How does Schematics protect the workspace data through Terraform state file, or log files? 

Follow these practices to protect your workspace data through Terraform state file, or log files.



* Use Cloud Identity and Access Management to control access to a Schematics Workspace, and related IBM Cloud resources.
* Secure the source repository for your Terraform template, including access control, security settings, collaboration, and version control.
* Secure the IBM Cloud resources that you create by using the security features that are provided by the resource offering.
* Use the provided tools of your IBM Cloud resources to apply security fixes, access controls, and encryption to your resources.



You need to specify the right [roles and permissions](https://cloud.ibm.com/docs/schematics?topic=schematics-accessaccess-setup) to a user who controls the state file. For more information about Schematics service access roles and permissions for



* [Workspace Permissions](https://cloud.ibm.com/docs/schematics?topic=schematics-accessworkspace-permissions)
The location can be in any IBM Cloud location, including major regions and locations outside the major regions. For more information, see [IBM® global data centers](https://www.ibm.com/cloud/data-centers/). 
 hipaa Either true or false. 
 kms_instance_crn An optional parameter that must be set to the CRN of the Key Protect instance housing the encryption key for BYOK. All IBM Cloudant environments are encrypted. If you would like to BYOK with Key Protect, supply the CRN of the Key Protect instance that holds the encryption key. Otherwise, don't supply this parameter in the CLI, which means the environment is encrypted with an IBM Cloudant-managed key. In order to BYOK with Key Protect, ensure that IBM Cloudant is authorized to access the selected key management service instance. You can manage service-to-service authorizations at any time by visiting Manage > Security > Identity and Access and choosing Authorizations. 
 kms_key_crn This parameter is required if you use the kms_instance_crn parameter. Otherwise, it must not be supplied in the CLI command. The kms_key_crn parameter is set to the CRN of the encryption key that is stored in the Key Protect instance that is defined by the kms_instance_crn parameter. 



The following example command includes the extra parameters.
With these, the service can now properly allow that entity to interact with them. How we enable this interaction is with something we call a "secret."

Now, with this dynamic established, let's move into an example with users. For users, we'll say that this user here is our entity, and we'll say our service here – let's say that it's a developer, and they happen to need read or write access. They're interacting with the development repo to do that. To gain that access again, coming back to the need, we have authorization and permission. How it's going to communicate, specifically in this circumstance, is by giving it user credentials. Now, that user can interact with the development repo in the way that they need to get their job done.

Now, looking at a cloud native application story, we have many microservices that must talk to each other. So, let's look at that. Let's call it service "A," that needs to interact with a database called "DB" and grab a piece of specific information that it needs to get its job done. What it needs, in the form of the secret here, is what we call "DB configs." Again, this DB config is going to allow it to have the correct communication with the service by saying, this is who I am and this is what I came here to accomplish.

But now that we have our user credentials in our DB configs as examples of secrets, we realize the vulnerability that can be created here if these credentials were to fall into the wrong hands. And this is why it's so important to establish a centralized place to manage all these things as we build out more applications and microservices. As we have more of these, the problem becomes more complex. If it falls into the wrong hands, how is protected? How do we block it from getting to that point? How was that data isolated?

When we look at the damage that this can cause, we're looking in the millions of dollars, for example, for a data breach.
When assigning an allowed IP policy to a Key Protect instance that has an existing allowed network policy, the IP addresses that are listed on the policy must access the instance from the network specified in the allowed network policy.
* ipWhitelist has been deprecated and replaced with allowedIP. Due to the deprecation of the previous ipWhitelist term, if you don't specify a query param while making a GET instance policies request, you will receive a duplicate allowed IP record when you retrieving your list of instance policies.





 Enabling and updating an allowed IP policy for your Key Protect instance 

As a security admin, you can enable or update an allowed IP policy for a Key Protect instance by making a PUT call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/instance/policies?policy=allowedIP

If you are updating your Key Protect instance's allowed IP policy, you will need to provide all of the IP addresses that are already allowed under the policy, as the new request will override the existing policy.



1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).

To enable and disable allowed IP policies, you must be assigned a Manager access policy for your Key Protect instance. To learn how IAM roles map to Key Protect service actions, check out [Service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).
2. Enable or update an allowed IP policy for your Key Protect instance by running the following curl command.
Security best practices for the instance metadata service 

IBM takes data security seriously and recommends you follow these best practices to ensure the highest level of protection for your instance metadata.



 Overview 

This topic describes how to configure security safeguards to protect your metadata by:



* Disabling the metadata service for an instance or an account.
* Limiting or not assigning trusted profiles for compute resource identities.
* Enhancing network security.







 Disable the metadata service for an instance or account 

You can disable the service on an existing instance where it is enabled. See [Enable or disable the instance metadata service](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-configure-service).





 Use iptables firewall to limit access on Linux 

Use the iptables Linux firewall utility to create a barrier between the metadata service link local address (trusted network) and the internet (untrusted network). Defines rules that govern which traffic is allowed and which is blocked.

The following example uses Linux iptables and its owner module, based on its default installation Apache ID, to prevent the Apache Web server from accessing the metadata link local address (169.254.169.254). It uses a deny rule to reject all instance metadata requests from any process that's running as that user.

sudo iptables --append OUTPUT --proto tcp --destination 169.254.169.254 --match owner --uid-owner apache --jump REJECT

This endpoint is accessible to all commands, processes, and software applications that are running within a virtual server instance. Access to the API endpoint is not available outside the virtual server instance. This step adds another level of security.

Another alternative is to use allow rules to define access to particular users or groups. Allow rules require you to decide what software needs access to instance metadata. By defining rules, you can prevent software from accidentally accessing the metadata service if you later change the software or configuration on the instance.

You can also define group usage of the allow rules. Add and remove users from a permitted group without changing the firewall rule.
You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed so that their problems will not be attributed erroneously to authors of previous versions.Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.The precise terms and conditions for copying, distribution and modification follow.TERMS AND CONDITIONS<-- </section "id="section-GPL-V3" "> --><-- <section "id="section-en-notice-def" "> --> 0. Definitions "This License" refers to version 3 of the GNU General Public License."Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks."The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you".
Check out the [tutorial](https://cloud.ibm.com/docs/vpc?topic=vpc-financial-transaction-confidential-computing-on-hyper-protect-virtual-server-for-vpc) and the [video](https://mediacenter.ibm.com/media/Confidential+Computing+for+a+financial+transaction+using+Hyper+Protect+Virtual+Server+for+VPC/1_vv3j2oo6) on Confidential Computing for a financial transaction using Hyper Protect Virtual Server for VPC. You can learn about how to protect Personally Identifiable Information and credit card information entered into web forms by using Confidential Computing on Hyper Protect Virtual Server for VPC.

For the on-prem version of Hyper Protect Virtual Servers, see [IBM Hyper Protect Virtual Servers v2.1](https://community.ibm.com/community/user/ibmz-and-linuxone/blogs/nicolas-mding/2022/10/06/ibm-hyper-protect-virtual-servers-v21).



 Hyper Protect Virtual Servers for VPC 

The Hyper Protect Virtual Servers for VPC takes advantage of the IBM Secure Execution for Linux to provide a boundary around each instance and provides the following benefits:



* Secure Execution boundary for protection from internal and external threats

Hyper Protect Virtual Servers for VPC provides technical assurance that unauthorized users, including IBM Cloud admins, do not have access to the application. Workloads are locked down by individual, instance-level secure boundaries.
* Multiparty contract and attestation of deployment

Apply Zero Trust principles from workload development through deployment. As multiple personas and legal entities collaborate, it’s essential to separate duty and access. Hyper Protect Virtual Servers for VPC is based on a newly introduced [encrypted contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_se) concept. It enables each persona to provide its contribution and be ensured through encryption that none of the other personas can access this data or intellectual property.
You can encrypt the contents of a contract. Although you can also pass in the contract through the User Data without encryption, it is recommended that you encrypt the contract. It is also recommended that you initially try to use a nonencrypted contract for testing purposes, and after it works as expected, you can use an encrypted contract for your production environment.

You can decide which sections of the contract need encryption. For example, you can choose to [encrypt only the workload section](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_encrypt_workload), or [encrypt only the env section](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_encrypt_env).

When the Hyper Protect Virtual Servers for VPC instance boots, the bootloader decrypts the contract. It takes the value of each of the sections in the contract and decrypts it if it is encrypted. If it finds that a section is not encrypted, it considers it as it is without any decryption. You must use the public key to encrypt the contract before you pass it as an input through the User Data section.

The encryption and attestation certificates are signed by the IBM intermediate certificate and this is signed by the IBM Digicert intermediate cert (which in turn is signed by DigiCert Trusted Root G4). For more information about the certificates, see [DigiCert Trusted Root Authority Certificates](https://www.digicert.com/kb/digicert-root-certificates.htm).



 Downloading the encryption certificate and extracting the public key 



1.
Protecting data with envelope encryption 

Key Protect uses envelope encryption to assist in protecting your Key Protect data. Envelope encryption involves encrypting your data with a Data Encryption Key, then encrypting the Data Encryption Key with a root key. This topic describes the process of envelope encryption and how to use Key Protect to encrypt and decrypt your data.

When working with sensitive data, it is important to use advanced encryption techniques to prevent a data breach. If you have large amounts of confidential data, it is often helpful to use a Key Management System to assist in keeping your data secure. Key Protect uses the envelope encryption technique to keep your data resilient. Envelope encryption is the process of using encrypted keys, Data Encryption Keys and Root Keys, to protect your sensitive data.

Imagine that you plan to send a letter to a colleague. You want to discuss information that is highly sensitive, so you generate a secret code (Data Encryption Key) that is used to write (encrypt) the message in the letter. The letter is delivered to a mailbox (wrapped Data Encryption Key) that can only be opened by those with a copy of the mailbox key (Root key), including the colleague. Anyone who does not have an exact copy of the key will be unable to open the mailbox and see it's contents. When your colleague uses the key to unlock (unencrypt) the mailbox, they will need to know the secret code that the letter is written in to be able to understand the message. Everyone who is not aware of the secret code will conclude that the letter is a random mix of characters and will not be able to understand the letter's contents.

Data encryption keys (DEKs) are designed to encrypt your data and can be generated and managed by your service or an IBM Cloud service.

Envelope encryption offers several benefits for protecting your data:



* Protection under a combination of multiple algorithms Envelope encryption uses the best benefits from symmetric and public key algorithms to keep your keys secure.



1. Symmetric key algorithms work faster, are more scalable, and more secure than public key algorithms. Public key algorithms use complicated mathematics that increase computational overhead, especially when dealing with large volumes of data.
* UI
* API







 Viewing a list of keys 

IBM® Key Protect for IBM Cloud® provides a centralized system to view, manage, and audit your encryption keys. Audit your keys and access restrictions to keys to ensure the security of your resources.

While you can [assign fine-grained access to a single key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keysgrant-access-key-level), note that calling the [list keys API](https://cloud.ibm.com/apidocs/key-protectgetkeys) will not return keys that you have assigned individual access to (that only you can access, in other words). Calling this API will however return the keys in key rings you have access to (if you have access to all of the keys in an instance, you will see all keys). You can, however, see the keys that only you have access to by following the instructions in [Viewing fine-grain access keys through IAM](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keys&interface=apifilter-key-state-gui-iams) to view the key through IAM or by using the API to pass the specific key ID.

It is a good practice to audit your key configuration regularly:



* Examine when keys were created and determine whether it's time to rotate the key.
* [Monitor API calls to Key Protect with Activity Tracker](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-events).
* Inspect which users have access to keys and if the level of access is appropriate.



For more information about auditing access to your resources, see [Managing user access](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access).



 Viewing keys in the console 

If you prefer to inspect the keys in your service by using a graphical interface, you can use the Key Protect dashboard.
Securing your data in Hyper Protect Virtual Servers 

To ensure that you can securely manage your data when you use IBM Cloud® Hyper Protect Virtual Servers, it is important that you know exactly what data is stored and encrypted and how you can delete any personal data. All data that is stored on Hyper Protect Virtual Servers disks is automatically encrypted and the encryption key is stored on a secure enclave.



 How your data is stored and encrypted in Hyper Protect Virtual Servers 

Hyper Protect Virtual Servers uses the following methods to protect your data:



* Hyper Protect Virtual Servers is built on [IBM Secure Service Container technology](https://www.ibm.com/us-en/marketplace/secure-service-container), and provides workload isolation, restricted administrator access and tamper protection for the underlying host system.
* The default SSH connection uses your private and public keypair for authentication and the connection is encrypted automatically.
* [Identity and Access Management (IAM)](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-iam-hpvs) secures access to the IBM Cloud account, the Hyper Protect Virtual Servers management Web user interface and CLI.
* All disks attached to a Hyper Protect Virtual Servers are provided on storage encrypted with LUKS according to AES-256. The default keys are managed by the underlying [IBM Secure Service Container technology](https://www.ibm.com/us-en/marketplace/secure-service-container).







 Protecting your sensitive data in Hyper Protect Virtual Servers 



 Data at rest 

The data that you store in Hyper Protect Virtual Servers is encrypted securely at rest by using a randomly generated key, which the underlying [IBM Secure Service Container technology](https://www.ibm.com/us-en/marketplace/secure-service-container) manages. Use the Linux command-line tools to delete data in a virtual server.





 Data in flight 

The IBM LinuxONE infrastructure components for the Hyper Protect Virtual Servers service are situated in colocation with the data centers. This means that these components are placed in the same data centers as the IBM Cloud infrastructure but have their own network setup, which affects the network connection.

Zoom

!