vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Security <br><br> * [Hyper Protect Crypto Services](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/hpcs)<br><br><br> <br><br> * [Hyper Protect Crypto Services](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/hpcs)<br><br><br> <br><br> * [App ID](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/appid_action_url)<br><br><br> 
 Logging and monitoring <br><br> * Activity Tracker Event Routing [11]<br> * [Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-api-setup)<br> * [Flow Logs for VPC](https://cloud.ibm.com/docs/vpc?topic=ibm-cloud-provider-for-terraform-getting-started)<br><br><br> <br><br> * Activity Tracker Event Routing<br> * [Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-terraform-setup)<br><br><br> 
 Integration <br><br> * [Event Streams](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-provider-templateevent-stream-snippet)<br><br><br>
Security <br><br> * [IBM Cloud® Hyper Protect Crypto Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-security-hpcs)<br><br><br> <br><br> * [IBM Cloud® Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started)<br> * [IBM Cloud® App ID](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-security-app-id)<br><br><br> 
 Logging and monitoring <br><br> * [IBM Cloud Activity Tracker Event Routing](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-logging-platform-events)[7]<br> * [IBM Cloud Security and Compliance Center](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-scc)<br> * [IBM Cloud® Flow Logs for VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-logging-flow-logs)[8]<br><br><br> 
 Integration <br><br> * [IBM® Event Streams for IBM Cloud®](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-integration-event-streams)<br><br><br> 
 Developer tools <br><br> * [IBM Cloud® Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-getting-started)<br><br><br>
System and Information Integrity (SI) [SI-3 Malicious Code Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-3) 







 15. Regularly scan for open ports / protocols 

Requirement: Regularly scan for open ports / protocols, and ensure only those ports / protocols needed by your service are open.

Purpose & value: As part of the principal of least privilege, you should only open the minimum number of ports / protocols that are needed by your service. Open ports / protocols not needed by your service enable unnecessary threat vectors. So, it is important to regularly scan to make sure the list of open ports / protocols is correct. Tools such as Nmap or Tenable can be used for this purpose.

Most Relevant Controls:



Table 15. Related controls for port scanning

 Family Control 

 Configuration Management (CM) [CM-7 Least Functionality](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-7) <br>[CM-7 (1)Least Functionality | Periodic Review](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-7.1) 







 16. Secure and manage secrets and certificates 

Requirement: Secrets must be securely protected through their entire lifecycle.

Purpose & value: A secret is any piece of data that is sensitive within the context of an application or service. Secrets include all of the following but are not limited to:



* Passwords of any type (database logins, OS accounts, functional IDs, etc.)
* API keys
* Long-lived authentication tokens (OAuth2, github, IAM, etc.)
* SSH keys
* Encryption keys
* Other private keys (PKI/TLS certificates, HMAC keys, signing keys, etc.)



You should should ensure:



* Secrets are generated and stored in the environment (e.g., dev, test, production) where your service is deployed.
Organizations consider the quality and completeness of the configuration management activities conducted by developers as evidence of applying effective security safeguards. Safeguards include, for example, protecting from unauthorized modification or destruction, the master copies of all material used to generate security-relevant portions of the system hardware, software, and firmware. Maintaining the integrity of changes to the information system, information system component, or information system service requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes. Configuration items that are placed under configuration management (if existence/use is required by other security controls) include: the formal model; the functional, high-level, and low-level design specifications; other design data; implementation documentation; source code and hardware schematics; the running version of the object code; tools for comparing new versions of security-relevant hardware descriptions and software/firmware source code with previous versions; and test fixtures and documentation. Depending on the mission/business needs of organizations and the nature of the contractual relationships in place, developers may provide configuration management support during the operations and maintenance phases of the life cycle.
[Follow secure development processes and ensure software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-development-processes) <br><br> * Ensure that security engineering principles are applied in the design, development, implementation, and modification of the system.<br> * Maintain software integrity by using signed images, applying security patches, doing vulnerability scans, and so on. For more information, see [Development processes and software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-development-processes).<br><br><br> <br><br> * Ensure that security engineering principles are applied in the design, development, implementation, and modification of resources in your IaaS / data center environment by using tools of your choosing.<br> * Maintain software integrity with tools of your choosing by using signed images, applying security patches, doing vulnerability scans, and so on.<br><br><br> 
 [Encrypt consumer data at rest and in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-encryption) <br><br> * Ensure that data at rest is always encrypted by using Hyper Protect Crypto Services to manage encryption keys. Ensure that all Financial Services Validated services that support integration with Hyper Protect Crypto Services are configured properly. For more information, see [Encryption at rest](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest).<br> * Ensure that data in transit is always encrypted by using TLS 1.2 or higher, including all traffic within your deployment and pods in your Red Hat OpenShift on IBM Cloud workload clusters.<br> * For any workloads hosted in IBM Cloud (not the Satellite location), use Hyper Protect Crypto Services for TLS offload for all data that is requested from outside of IBM Cloud (inbound traffic to IBM Cloud) and protected by a certificate that is signed by a public certificate authority.
[Security considerations for initializing a service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialization-security-policyinitialization-security-policy)



* [Considerations for storing signature keys and master key parts](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialization-security-policyconsideration-key-parts)
* [Considerations for defining the Management Utilities security policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialization-security-policysmart-card-security-plan)
* [Considerations for defining the file security policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialization-security-policyfile-security-plan)







 Understanding your responsibilities when using IBM Cloud Hyper Protect Crypto Services 

[Understanding your responsibilities when using IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilitiesshared-responsibilities)



* [Incident and operations management](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilitiesincident-and-ops)
* [Change management](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilitieschange-management)
* [Identity and access management](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilitiesiam-responsibilities)
* [Security and regulation compliance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilitiessecurity-compliance)
* [Disaster recovery](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilitiesdisaster-recovery)







 High availability and disaster recovery
Security <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/apidocs/hs-crypto)<br><br><br> <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/apidocs/hs-crypto)<br><br><br> <br><br> * [App ID](https://us-south.appid.cloud.ibm.com/swagger-ui//)<br><br><br> 
 Logging and monitoring <br><br> * [Activity Tracker Event Routing](https://cloud.ibm.com/apidocs/atracker/atracker-v2)<br> * [Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-api-setup)<br> * [Flow Logs for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environment&interface=api)<br><br><br> <br><br> * [Activity Tracker Event Routing](https://cloud.ibm.com/apidocs/atracker/atracker-v2)<br> * [Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-api-setup)<br><br><br> 
 Integration <br><br> * [Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-admin_api)<br><br><br>
SA-12 - Supply Chain Protection 



  Control requirements 

SA-12 - 0
:   The organization protects against supply chain threats to the information system, system component, or information system service by employing [IBM Assignment: IBM-defined personnel security requirements, approved HW/SW vendor list/ process, and secure SDLC procedures] as part of a comprehensive, defense-in-breadth information security strategy.





  NIST supplemental guidance 

Information systems (including system components that compose those systems) need to be protected throughout the system development life cycle (i.e., during design, development, manufacturing, packaging, assembly, distribution, system integration, operations, maintenance, and retirement). Protection of organizational information systems is accomplished through threat awareness, by the identification, management, and reduction of vulnerabilities at each phase of the life cycle and the use of complementary, mutually reinforcing strategies to respond to risk. Organizations consider implementing a standardized process to address supply chain risk with respect to information systems and system components, and to educate the acquisition workforce on threats, risk, and required security controls. Organizations use the acquisition/procurement processes to require supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services. Security safeguards include, for example: (i) security controls for development systems, development facilities, and external connections to development systems; (ii) vetting development personnel; and (iii) use of tamper-evident packaging during shipping/warehousing. Methods for reviewing and protecting development plans, evidence, and documentation are commensurate with the security category or classification level of the information system. Contracts may specify documentation protection requirements.
Server security Intel Trusted Execution Technology (TXT) provides hardware-assisted security technologies to enhance your security portfolio and act as an extra security for your infrastructure. 
 Business continuance insurance (BCI) Business continuance insurance helps you avoid overage charges if you experience a network attack (DDOS) that uses all of your allowed bandwidth. 
 Firewall A hardware firewall provides an extra layer of security that is provisioned on demand without service interruptions. This firewall prevents unwanted traffic from reaching your servers by reducing your attack surface, and by enabling your server resources to be dedicated for their intended use. For more information, see [Getting started with Hardware Firewall](https://cloud.ibm.com/docs/hardware-firewall-shared?topic=hardware-firewall-shared-getting-started). 
 Monitoring - host ping Basic monitoring is used to initiate service and slow pings to make sure that the device is online and responsive. For more information, see [Basic monitoring](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-monitoring-iaasbasic-monitoring). 
 Notification You can define an alert on a single metric or a set of metrics to notify you of events or issues that you want to monitor. For more information, see [Working with alerts](https://cloud.ibm.com/docs/monitoring?topic=monitoring-alerts). 
 Response Automated response to your monitored metrics notifications. 
 Public secondary IP addresses You can request extra IP addresses for your server, which is recommended if you announce services externally. For more information about secondary IP addresses, see [Secondary subnets](https://cloud.ibm.com/docs/subnets?topic=subnets-about-subnets-and-ipsstatic-subnets). If you need extra IP addresses later, you can always order extra secondary subnets. For more information, see [Ordering secondary subnets and global IP addresses](https://cloud.ibm.com/docs/subnets?topic=subnets-order-subnets).
System and Communications Protection (SC) [SC-2 Application Partitioning](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-2) <br>[SC-3 Security Function Isolation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-3) 







 6. Enforce information flow policies and protect the boundaries of your application 

Requirement: Leverage the components of the reference architecture to enforce policies for information flows and to protect the boundaries of your application.

Purpose & value: Information flow control determines where information is allowed to travel within the components of your service offering as well as to/from other interconnected systems. Information flow control is intended to reduce the risk of sensitive information flowing from one system to another that has less stringent security policies. Flow control is based on the characteristics of the information (e.g., is the content of an information payload valid?) and/or the information path (e.g., is the information coming from a trusted IP address?).

Boundary protection increases security by monitoring and restricting communications at the external network boundary and key internal boundaries of your service. Boundary protection devices (e.g., gateways, encrypted tunnels, hardware and virtual firewalls, etc.) are commonly employed.

Implementation guidance:



* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-overview)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-connectivity-overview)



Most Relevant Controls:



Table 6. Related controls for boundary protection

 Family Control
Although the value is kept secure within the Continuous Delivery service, the service cannot protect the value on the client side. When you set a secure property by using the console in your browser, by calling an API, or by configuring a Terraform resource, the plain text secret might be exposed on your local systems. Plain text secrets are also more difficult to rotate. When a secret, such as an API key, must be rotated, all secure properties that carry the secret value must also be located and updated.

When you set a secure property with a secrets reference value, the value is a specially formatted string that refers to the location or address of a secret that is managed within a secrets storage service such as [IBM® Key Protect for IBM Cloud®](https://cloud.ibm.com/docs/key-protect), [IBM Cloud® Secrets Manager](https://cloud.ibm.com/docs/secrets-manager), or HashiCorp Vault. Although Continuous Delivery actively encrypts and stores the secrets reference value internally, the secret value is not exposed on the client side. When Continuous Delivery must retrieve the secret to perform processing on your behalf, it internally retrieves the value from the referenced secrets store. Secrets references are also resilient to rotation. Typically, when a secret is rotated within a secrets store, the location or address of the secret remains the same. Only the secret value itself is changed.

Two types of secrets references are supported: by name or by [Cloud Resource Name (CRN)](https://cloud.ibm.com/docs/account?topic=account-crn). Currently, only [Secrets Manager](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-secretsmanager) tool integrations support referencing secrets by CRN. This format allows for greater flexibility because you can reference secrets from a Secrets Manager instance in a different account if the correct [authorization](https://cloud.ibm.com/iam/authorizations) is in place.

Make sure that you consider the following prerequisites for specifying a secrets reference within the scope of a toolchain:



* The secrets store must be added to the toolchain as a tool integration.
Requirement ID Rules 

 SA-9 (a) <br><br> * Check whether provisioned services are IAM enabled<br> * Check whether the Financial Services Validated setting is enabled in account settings<br><br><br> 







 NIST supplemental guidance 

External information system services are services that are implemented outside of the authorization boundaries of organizational information systems. This includes services that are used by, but not a part of, organizational information systems. FISMA and OMB policy require that organizations using external service providers that are processing, storing, or transmitting federal information or operating information systems on behalf of the federal government ensure that such providers meet the same security requirements that federal agencies are required to meet. Organizations establish relationships with external service providers in a variety of ways including, for example, through joint ventures, business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, and supply chain exchanges. The responsibility for managing risks from the use of external information system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a level of confidence that each participating provider in the potentially complex consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust varies based on the relationships between organizations and the external providers. Organizations document the basis for trust relationships so the relationships can be monitored over time. External information system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define expectations of performance for security controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.
This can be part of the regular activities of (agile) development and the next steps towards a fully secure app or by increasing requirements for an app already in production.

If you tried the tutorial on how to [apply end to end security to a cloud application](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cloud-e2e-security), you already know how to rotate service credentials. But there is far more to app security than regular changes of passwords and access keys. You may want to assess the application, its deployment and usage characteristics to better understand what needs to, could be and should be addressed. It helps you to move towards a [zero trust security model](https://en.wikipedia.org/wiki/Zero_trust_security_model). Moreover, depending on your industry, country and region, etc. there exist different [security and resiliency requirements](https://www.ibm.com/cloud/compliance). It could mean



* to isolate the application, its services, the network traffic and stored data from those of other applications,
* to encrypt data and have control over the management of encryption keys,
* to log all kind of events, regularly analyze logs and keep them for audits or incident forensics,
* to organize DevOps activities and the related teams with more fine-grained privileges,
* and much more.



To assess your application and its resources, consider the [IBM Cloud® Security and Compliance Center](https://www.ibm.com/cloud/security-and-compliance-center). It allows to govern resource configurations. You can set up and manage security and compliance controls. Checks can be automated. Results are directly compared against defined controls, can be exported and integrated into a customized dashboard. Read how to [get started with Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started) for the first steps.





 Isolate runtime environments, networks traffic and data 

One of the fundamental principles of Cloud Computing is the sharing of resources.