vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Protecting a virtual server 

Hyper Protect Virtual Servers is a service that is used to provide highly secure virtual servers. The difference to common virtual servers from a security perspective is that an instance that is created from this IBM Cloud® service runs on a secured stack. Even IBM Cloud system administrators can't access your data nor track your usage. They don't have an insight into the security status of your virtual server. They are also limited in how they can set up or change for your virtual server configuration.

However, the virtual server is still a virtual server, which is accessible from the internet. From a security perspective, you need to protect the virtual server instance itself.

Do not use personal information, for example, your name, as the instance name or as part of the instance name. The data that you provide when you provision an instance or interact with the hpvs cli is not considered to be personal data or credentials. Learn more about IBM Cloud Hyper Protect Virtual Servers' Data usage and Certifications [here](https://www.ibm.com/software/reports/compatibility/clarity-reports/report/html/softwareReqsForProduct?deliverableId=165C6EF0FFDA11E8BABD512A6952EE1F)

For Ubuntu, different System Hardening Guide documents are available.

The Ubuntu operating system that is provided for your virtual servers is part wisely hardened according to the CIS Ubuntu Linux 20.04 LTS Benchmark, Level 1- Server profile, which means that the operating system is more secure than the standard Ubuntu image. However, it still might not be secure enough to meet to your requirements. Select a System Hardening Guide depending on your companies’ location and policies.

The subsequent description presents an overview of the features that are implemented for the Ubuntu OS offered with Hyper Protect Virtual Servers.

As part of the hardening, IBM installed and configured AIDE (Advanced Intrusion Detection Environment), which is a file and directory integrity checker. With the implemented configuration, AIDE is run as a cron job every 5 minutes while the server is running.

The firewall allows all outgoing TCP, UDP, and ICMP traffic.
What's the difference between using Key Protect as my KMS compared to Hyper Protect Crypto Services? When would I use one over the other? 

Both key management systems provide you complete control over your data, managed by your root keys. Key Protect is a multi-tenant KMS where you can import or create your root keys and securely manage them. Hyper Protect Crypto Services is a single-tenant KMS and hardware security module (HSM) that is controlled by you, which offers the highest level of security. For more information about these key management services, see [Supported key management services for customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutkms-for-byok).
* Can I convert my volume from provider-managed encryption to customer-managed encryption?

 Can I convert my volume from provider-managed encryption to customer-managed encryption? 

No, after you provision a volume and specify the encryption type, you can't change it.
* Is there a way to copy the block storage volume to a different zone?

No. You can't copy the storage volume to a different zone. However, you can create a copy of a snaphot of a volume in a different zone, and restore a volume from that snapshot.
* What elements do I need to create to set up auto scaling?

If you are using IBM Cloud console, you need to create an instance template, an instance group, and if you choose the dynamic scaling method, you must create scaling policies. For more information, see [Setting up auto scale with the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-groupsetting-up-autoscale-overview). If you are using the IBM Cloud CLI or API you must also create an instance group manager. For more information, see [Setting up auto scale with the CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-groupsetting-up-auto-scale-with-the-cli).
* How much am I charged for using auto scale?
IA-5 (6) - Protection of Authenticators 



  Control requirements 

IA-5 (6) - 0
:   The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access.





  NIST supplemental guidance 

For information systems containing multiple security categories of information without reliable physical or logical separation between categories, authenticators used to grant access to the systems are protected commensurate with the highest security category of information on the systems.
Also, see [API Key vs HMAC](https://cloud.ibm.com/docs/cloud-object-storage/iam?topic=cloud-object-storage-service-credentialsservice-credentials-iam-hmac).
* How do cross-origin resource sharing (CORS) and a bucket firewall differ in limiting access to data?

CORS allows interactions between resources from different origins that are normally prohibited. A bucket firewall allows access only to requests from a list of allowed IP addresses. For more information on CORS, see [What is CORS?](https://cloud.ibm.com/docs/CDN?topic=CDN-cors-and-cors-requests-through-your-cdnwhat-is-cors).
* How do I allow Aspera High-Speed Transfer through a bucket with context-based restrictions or a firewall?

The full list (in JSON) of Aspera High-Speed Transfer IP addresses that are used with IBM Cloud Object Storage can be found [using this API endpoint](https://ats.aspera.io/pub/v1/servers/softlayer).
* Does Object Storage provide encryption at rest and in motion?

Yes. Data at rest is encrypted with automatic provider-side Advanced Encryption Standard (AES) 256-bit encryption and the Secure Hash Algorithm (SHA)-256 hash. Data in motion is secured by using the built-in carrier grade Transport Layer Security/Secure Sockets Layer (TLS/SSL) or SNMPv3 with AES encryption.

If you want more control over encryption, you can make use of IBM Key Protect to manage generated or "bring your own" keying. For details, see [Key-protect COS Integration](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-cos).
* Is there additional encryption processing if a customer wants to encrypt their data?

Server-side encryption is always on for customer data. Compared to the hashing required in S3 authentication and the erasure coding, encryption is not a significant part of the processing cost of Object Storage.
[LUKS passphrase generation](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/hpvs-luks.svg)

LUKS passphrase generation

The key daemon is started if the volume is secured with protection from the KMS instance. It's responsible for reacting to status changes of the CRK (which will be introduced later in this documentation).



 About customer-managed keys 

Hyper Protect Virtual Servers for VPC use

envelope encryptionto implement customer-managed keys. Envelope encryption describes encrypting (wrapping) one encryption key with another encryption key. In our case, the wrapped key is the third seed, and the key that's used to wrap the seed is the CRK from Hyper Protect Crypto Services.

You own the CRK in Hyper Protect Crypto Services. Hyper Protect Virtual Server for VPC never sees the CRK. Its storage, management, and use to wrap and unwrap the seed is performed entirely within the key management service.

Hyper Protect Crypto Services is backed by FIPS 140-2 Level 4-certified hardware, which is the highest offered by any cloud provider in the industry. For more information, see [Getting started with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).





 Enabling customer-managed keys for Hyper Protect Virtual Servers for VPC 

Whether you can enable the feature depends on the history of the Hyper Protect Virtual Server instance (partition layout and LUKS encryption) and the contract information. See the following table for possible scenarios and results. If you don't know what kms details in the contract mean, see the instructions in [Steps](https://cloud.ibm.com/docs/vpc?topic=vpc-hyper-protect-virtual-server-mng-datasteps-to-enable).



Table 1. Scenarios
* IBM purchases Professional Errors and Omissions including cyber risk insurance (see below) for IBM's liability arising out of actual or alleged breach of duty, neglect, error, misstatement, misleading statements or omission committed in the conduct of IBM’s professional services. This includes coverage for loss of intangible property, such as customer data, due to IBM’s negligence. This coverage is global in scope.







 DDoS Protection 



* IBM Cloud provides DDoS (Distributed Denial of Service) protection for its environment, designed to protect the entire network. IBM Cloud uses automated DDoS mitigation controls and an in-house Network Operations Center (NOC) team to monitor network performance and security 24x7.







 Media Sanitization 



* IBM securely sanitizes physical media intended for reuse prior to such reuse, and will destroy physical media not intended for reuse, consistent with National Institute of Standards and Technology, United States Department of Commerce (NIST) guidelines for media sanitization (see link below)



[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf)





 Cyber Insurance 



* IBM carries standard cyber risk insurance under its Professional Errors & Omissions policy. PE&O insurance provides coverage for actual or alleged breach of duty, neglect, error, misstatement, misleading statements or omission, solely for acts or omissions committed by IBM in providing professional services to our client(s). Coverage includes network security, unauthorized access, unauthorized use, receipt or transmission of a malicious code, denial of service attack, unauthorized disclosure or misappropriation of private information, privacy liability, notification costs, credit card monitoring, and fine & penalties incurred by the customer.



The PE&O Policy itself is IBM Confidential information.
Understanding your responsibilities with using Key Protect 

Learn about the management responsibilities and terms and conditions that you have when you use IBM® Key Protect for IBM Cloud®.

For a high-level view of the service types in IBM Cloud and the breakdown of responsibilities between the customer and IBM for each type, see [Shared responsibilities for IBM Cloud offerings](https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilities).

Review the following sections for the specific responsibilities for you and for IBM when you use IBM Key Protect. For the overall terms of use, see [IBM Cloud Terms and Notices](https://cloud.ibm.com/docs/overview?topic=overview-terms).



 Incident and operations management 

You and IBM share responsibilities for the set up and maintenance of your IBM Key Protect instance for your application workloads.

You are responsible for incident and operations management of your application data.



Table 1. Responsibilities for incident and operations

 Task IBM Responsibilities Your Responsibilities 

 Availability Provide high availability capabilities, such as IBM-owned infrastructure in multizone regions, to meet local access and low latency requirements for each supported region. Use the list of [available regions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regions) to plan for and create new instances of the service. 
 Monitoring Provide integration with select third-party partnership technologies, such as IBM Cloud® Activity Tracker. Use the provided tools to [review instance logs and activities](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-events). 
 Incidents Provide notifications for planned maintenance, security bulletins, or unplanned outages. Set preferences to [receive emails about platform notifications](https://cloud.ibm.com/docs/overview?topic=overview-uiemail-prefsl), and monitor the [IBM Cloud status page](https://cloud.ibm.com/status?selected=announcement) for general announcements. 







 Change management 

You and IBM share responsibilities for keeping IBM Key Protect service components at the latest version.

You are responsible for change management of your application data.



Table 2. Responsibilities for change management
* Secondary: 208.91.112.52





FortiGate Security Appliance 10 Gbps



* What is the difference between FortiGate Security Appliance (FSA) 10 Gbps and FSA 1 Gbps? What about Virtual Router Appliance?

FSA 10 Gbps provides faster throughput compared to FSA 1 Gbps. It allows the customer to protect multiple VLANs (both private and public). More add-ons such as Anti-Virus (AV), Intrusion Prevention (IPS), and web filtering can be enabled on demand.

Virtual Router Appliance also protects multiple VLANs. However, Virtual Router Appliance does not provide next-generation firewall add-ons and purpose-built security processors.
* Can FSA 10G and a network gateway be associated with the same VLAN?

No, it is not possible to have an FSA 10G and a network gateway device to be associated with the same customer VLAN.
* Does this offering charge for private network connectivity?

IBM offers private connectivity free of charge, which is one of the key differentiators in the marketplace.
* Is FSA 1 Gbps also a multi-VLAN offering?

No, only FSA 10 Gbps supports multiple VLANs.
* Is FSA 10 Gbps available in Federal data centers?

FSA 10 Gbps is not currently available in Federal data centers.
* Can an FSA 10 Gbps be used in place of a Virtual Router Appliance?

Yes.
* Do you plan to upgrade FSA 1G with the same capability of the FSA 10G appliance?

Not currently.
* Can the FSA 10 Gbps span over multiple pods in a data center?

Not currently. FSA 10 Gbps is only able to protect VLANs for the pod it is deployed in.



Hardware Firewall



* What is a firewall?

A firewall is a network device that is connected upstream from a server. The firewall blocks unwanted traffic from a server before the server is reached.
* Why should I use a firewall?
System and Communications Protection (SC) [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 7. Ensure all operator actions are executed through a bastion host 

Requirement: Ensure all interactive operator actions can only be run through a bastion host in your dedicated edge or management plane which is properly isolated from your workload plane. Enable recording of bastion sessions for auditing.
* Better - This offer is built on the benefits of the Good option, with the addition of BIG-IP DNS™, BIG-IP Advanced Firewall Manager™ (AFM), and BIG-IP Application Acceleration Manager™ (AAM) modules. It delivers global traffic management services, application performance optimization, and advanced network firewall and Distributed Denial of Service (DDoS) mitigation capabilities.
* Best - In addition to the Good and Better offers, BIG-IP Application Security Manager™ (ASM) provides:



* Comprehensive application protection against L7 DDoS
* Open Web Application Security Project (OWASP) top 10 threats
* Common application vulnerabilities





BIG-IP Access Policy Manager™ (APM) offers users secure, simplified access to applications located anywhere within a multicloud environment, incorporating features such as SSO (Single Sign-On) and MFA (Multifactor Authentication).

You cannot change the license model after service installation. To change the license model, you must delete the existing service and reinstall the service by choosing a different license model.







 Related links 



* [F5 BIG-IP overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations)
* [Managing F5 BIG-IP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-managing_f5)
* [Ordering services for vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservices)
* [Contacting IBM® Support](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-trbl_support)
* [FAQ](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq-vmwaresolutions)
* [F5 Deployment Guides](https://www.f5.com/services/resources/deployment-guides)
In such cases, auto scaling can help in keeping resources allocated according to the needs. Of course, the data across the two sites is continuously synced with some kind of replication mechanism.





 Site strategy 

Site strategy is the most predominant aspect of the overall resiliency solution because it determines what classes of physical events the solution is able to address, sets the requirements in terms of distances, and it also sets constraints on the technology side.

IBM Cloud offers a redundant infrastructure with several layers of resiliency that can be summarized as:

Local
: A physical and logical separation zone, for example an availability zone or availability set, within a cloud location, such as a data center, that is independent from other zones for what pertains to power supply, cooling, and networking.

Site
: Multiple sites in a region. Using different sites within the same region offers a better level of protection in case of a limited natural disaster, compared to two different zones on a single site. Sites in the same region are usually in close proximity (tens of miles).

Region
: Using two sites in two regions in the same geography represents the highest level of protection against natural disasters as sites are generally over 400 kilometers or 250 miles apart.

Geography
: Selecting two sites in different geographies extends the level of protection against natural disasters. Geographies are generally over 1500 kilometers or 1000 miles apart, thus representing the optimal option in terms of wider protection requirements.

The analysis of the cloud sites for the DR of your cloud-enabled workloads is relevant to avoid problems because of latency. Multiple sites in the same region help to implement DR with near zero RPO. And, remote secondary sites far from the primary site might require asynchronous techniques to be evaluated in your design.

For more information, see [How IBM Cloud ensures high availability and disaster recovery](https://cloud.ibm.com/docs/overview?topic=overview-zero-downtime).





 Plan and design for the “worst conditions” 

When designing your resiliency solution, the key is in the word “resiliency".
The brochure for Thales Luna HSMs can be found [here](https://cpl.thalesgroup.com/encryption/hardware-security-modules/network-hsms).



 Network connectivity between Key Protect and HSM (recommended) 

The best practice network configuration is to use 10Gb links for cryptographic traffic between Key Protect and your HSMs and a bond of 2Gb links for management and administration traffic. Key Protect requires TCP connectivity to HSM on port 1792 for NTLS protocol. To check the connectivity, issue a netcat command on the worker nodes which would be assigned to Key Protect:

nc -vz <HSM-ipaddr> 1792

Where HSM-ipaddr is the IP address of your HSM.

Bonding provides standby fault tolerance reliability, but does not provide load balancing.





 Partitions and partition types 

If you have new or factory-reset HSMs, you must create an application partition to work with the Key Protect service. [Follow the instructions in your HSM provider](https://thalesdocs.com/gphsm/luna/7/docs/network/Content/admin_partition/Preface.htm) to create a partition, keeping in mind that your partition label and partition crypto officer password must be the same for the partition in both HSMs that will be connected to Key Protect. This is because the partition crypto officer password is consumed by Key Protect as part of the PKCS#11 session API login process.

The Thales SafeNet Luna Network HSM uses two types of partitions:



* Administrative partitions: This is where HSM-wide policies are set and changed, application partitions are created or destroyed, HSM firmware and capabilities are updated, and so on.
* Application partition: This is where cryptographic operations are performed by user applications. While it is only possible to have only one administrative partition in a given HSM, it is possible to have multiple application partitions to address multi-tenancy configurations. This is achieved by partitioning the key storage space into multiple application partitions, with the ability to set the size of each partition. A user of a tenant has no way to see the other application partitions.
Using Hyper Protect Crypto Services with Unified Key Orchestrator to manage keys in Key Protect on Satellite 

[IBM Cloud Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-getting-started) provides you with flexibility and scalability to bring your own infrastructures to IBM Cloud. You can run IBM Cloud services anywhere including on your on-prem data centers and other cloud providers. With IBM Cloud Satellite, you can connect your multiple environments to implement distributed cloud solutions to help your enterprise hybrid cloud transformation. Key Protect on Satellite allows you to fully control your encryption keys by using your on-prem hardware security module (HSM). Hyper Protect Crypto Services with Unified Key Orchestrator enables you to manage keys in various key management systems, including Key Protect on Satellite, from a single pane of glass.

In this topic, references to Unified Key Orchestrator refer to Hyper Protect Crypto Services with Unified Key Orchestrator service.



 Objectives 

This tutorial shows how you can keep complete and exclusive control of your encryption keys by deploying Key Protect in a Satellite location and how you can manage your distributed keys with a unified view by connecting Unified Key Orchestrator to Key Protect on Satellite.

The following diagram illustrates the architecture:

Zoom

![Unified Key Orchestrator connects to Key Protect on Satellite](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto/images/uko-kp-satellite.svg)

Figure 1. Unified Key Orchestrator connects to Key Protect on Satellite





 Before you begin 

To complete this tutorial, you need to meet the following prerequisites:

Currently, Key Protect supports user-owned on-prem Satellite locations associated with the IBM Cloud us-east region only. In this tutorial, to reduce network latency, we create other IBM Cloud services needed also in the us-east region.



* Read through the [About Key Protect on Satellite](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-about) to understand the products and restrictions.