vania-janet/multiturn-rag-retrieval-data huggingface dataset:
It is analogous to the “friends-only” or “public/private” controls on social media accounts used to restrict who can or can’t see your otherwise public posts.

With IBM Cloud VPC, you can use the UI, CLI, and API to manually provision virtual server instances for VPC with high network performance. VPC infrastructure contains a number of Infrastructure-as-a-Service (IaaS) offerings, including virtual servers for VPC. Use the following information to understand a simple use case for planning, creating, and configuring resources for your VPC, and learn about more VPC overviews and VPC tutorials. For more information about VPC, see [Getting started with Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).





 SAP solution implemented 

SAP BW/4HANA is a packaged data warehouse based on SAP HANA. As the on-premises data warehouse layer of SAP’s Business Technology Platform, SAP BW/4HANA can be used to consolidate data across the enterprise to get a consistent, agreed-upon view of your data.

SAP BW/4HANA is a next-generation data warehouse SAP product that, like SAP S/4HANA®, is optimized for the SAP HANA platform, including inheriting the high performance, simplicity, and agility of SAP HANA. SAP BW/4HANA delivers real-time, enterprise-wide analytics that minimize the movement of data and can connect all the data in an organization into a single, logical view, including new data types and sources. Organizations now have a data warehousing solution that can meet their current and future business needs. A solution that handles more data, from more sources to deliver the solutions that increase an organization’s success in the next generation of business.

SAP BW/4HANA, combined with SAP S/4HANA and the SAP HANA platform, combines traditional data warehousing, such as operational reporting and historical analysis, with the future - logical data warehouse, Internet of Things, and data lakes.

SAP BW/4HANA combines with SAP S/4HANA to meet your operational and historical analytics needs by using the same data as your applications, so you are always using fresh data.
With Portworx, you can choose to [set up volume encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_encryption) to protect your data during transit and at rest. The IBM Cloud infrastructure storage instances save the data on encrypted disks, so your data at rest is encrypted.







 Understanding Key Management Service (KMS) providers 

You can protect Kubernetes secrets and any credentials stored in a secret by enabling a [key management service (KMS) provider](https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/) which provides an encryption solution using a root key you control.



 Available KMS providers 

By default, Red Hat OpenShift on IBM Cloud supports the following KMS providers.



* IBM® Key Protect for IBM Cloud® for [public cloud](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial) or [on-prem](https://www.ibm.com/docs/en/cloud-private/3.2.0?topic=apis-key-management-service) environments.
* [Hyper Protect Crypto Services](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services) for keep your own key (KYOK) crypto unit support.



Because adding a different KMS provider requires updating the managed master default configuration, you can't add other KMS providers to the cluster.

You can have one KMS provider enabled in the cluster. You can switch the KMS provider, but you can't disable KMS provider encryption after it is enabled. For example, if you enabled a key management service (KMS) provider in your cluster, but want to use Hyper Protect Crypto Services instead, you can [enable](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) Hyper Protect Crypto Services as the KMS provider.

You can't disable KMS provider encryption.
So within here, we have profile DB, and we know that the set of permissions that we want to grant are going to be read permissions for table A. So again, where are we going to store the secret that's ultimately going to give us access to give us access to authentication and ultimately to the set of permissions that we need here? So that's again going to be the secrets manager service provided, and that service needs to talk to Cloud IAM again. Now that we've got this established, what type of credential do we have here? The credential that we have is called DB config. So let's think about the scenario we just walked through: this DB config allows this lending application a service to be able to have read access or be able to take a specific set of information from a given table within a database that has some IP data and some other highly sensitive information in it. So, in a scenario in which these DB configs are not stored properly or the service that they stored in is compromised, what we ultimately get is a pretty catastrophic scenario for the provider, because the provider of this service of this lending application then has to go and tell its customer that a bad actor was able to take advantage of access that it got wrongfully to its DB config. And, that DB config ultimately allowed that bad actor to steal their data and do whatever they wanted with it against that customer. What we can do to mitigate it again is stored in a safe location or bad actors do not have access and you have the level of data isolation that you're comfortable with as an enterprise. That's where we have secrets manager services.

Again, secrets manager services help to ensure the secure storage of secrets so that you don't have to worry about data breaches from last credentials or from other types of secrets. And, ultimately, it makes it a little more efficient for the management of your secrets while you're going through your DevOps operations.

Thank you. If you have questions, please drop us a line. If you want to see more videos like this in the future, please like and subscribe, and don't forget you can grow your skills and earn a badge with IBM Cloud Labs which, are free browser-based interactive Kubernetes labs.
Information security 

IBM® is committed to providing our clients and partners with innovative data privacy, security, and governance solutions.

Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that might affect the clients’ business and any actions the clients might need to take to comply with such laws and regulations.

The products, services, and other capabilities described herein are not suitable for all client situations and might have restricted availability. IBM does not provide legal, accounting or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation.

If you need to request GDPR support for IBM Cloud® Watson resources that are created



* In the European Union (EU), see [Requesting support for IBM Cloud Watson resources created in the European Union](https://cloud.ibm.com/docs/watson?topic=watson-gdpr-sarrequest-EU).
* Outside of the EU, see [Requesting support for resources outside the European Union](https://cloud.ibm.com/docs/watson?topic=watson-gdpr-sarrequest-non-EU).





 European Union General Data Protection Regulation (GDPR) 

IBM is committed to providing our clients and partners with innovative data privacy, security and governance solutions to assist them on their journey to GDPR compliance.

Learn more about IBM's own GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey [here](http://www.ibm.com/gdpr).





 Health Insurance Portability and Accountability Act (HIPAA) 

IBM Cloud

US Health Insurance Portability and Accountability Act (HIPAA) support is available for Premium plans that are hosted in the Washington, DC, (us-east) and Dallas (us-south) locations. For more information, see [Enabling EU and HIPAA supported settings](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedeu-hipaa-supported).

Do not include personal health information (PHI) in data that is to be added to custom models.
You do not have the correct authorization to perform Key Protect actions in the specified service instance.

 How to fix it 

Verify with an administrator that you are assigned the correct platform and service access roles in the applicable Key Protect instance. For more information about roles, see [Roles and permissions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).





 Unable to view or list keys 

When you try to list keys by using the Key Protect API, you're unable to view any keys in a Key Protect instance that you have access to.

 What’s happening 

You call GET api/v2/keys to list the keys that are available in your service instance. The system returns a response similar to the following JSON object:

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 0
}
}

 Why it’s happening 

You do not have the correct authorization to view the requested range of keys.

 How to fix it 

Contact an administrator to check your permissions. If the Key Protect instance contains keys that you're unable to view, verify that you're assigned the applicable [level of access to keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keys) in the Key Protect instance. If the instance contains more than 200 keys, you need to use the [offset and limit parameters](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysretrieve-subset-keys-api) to list another subset of keys.

For example, if you want to list keys 201 - 210 that are available in a service instance, you use ../keys?offset=200&limit=10 to skip the first 200 keys.





 Unable to view or list specific keys 

When you call the Key Protect API, you're unable to list specific keys that you have access to.

 What’s happening
Securing your data in Data Engine 

To ensure that you can securely manage your data when you use IBM Cloud® Data Engine, it is important to know exactly [what data is stored and encrypted](https://cloud.ibm.com/docs/sql-query?topic=sql-query-keyprotectconsiderations) and how you can delete any stored data. Depending on your security requirements, you can encrypt data with customer-managed keys by integrating with IBM Cloud key management services such as Key Protect, which supports the Bring Your Own Key (BYOK) method.



 How your data is stored and encrypted in Data Engine 

All data that is stored in Data Engine has by default service-managed encryption. You can also choose to encrypt with BYOK using IBM® Key Protect for IBM Cloud®. SQL query text and error messages can be encrypted by associating a IBM® Key Protect for IBM Cloud® during instance creation. Table metadata is encrypted by using the same mechanism for all tables or views that were created after August 23rd, 2022. All table metadata that was created before that date is encrypted by using service-managed encryption. You can re-create tables to convert the encryption method to BYOK by using IBM® Key Protect for IBM Cloud®.





 Protecting your sensitive data in Data Engine 

You can add a higher level of encryption protection and control to your data at rest (when it is stored) by enabling integration with Key Protect. The data that you store in IBM Cloud is encrypted at rest by using a service-managed key. If you need to control the encryption keys, you can integrate Key Protect. This process is commonly referred to as Bring your own keys (BYOK). With Key Protect you can create, import, and manage encryption keys. You can assign access policies to the keys, assign users or service IDs to the keys, or give the key access only to a specific service. The first 20 keys are free.



 Enabling customer-managed keys for Data Engine
"allowed_network": "<access_type>"
}
}
}
]
}'

Replace the variables in the example request according to the following table.



Table 1. Describes the variables needed to set a network access policy at the instance level

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-de, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 enabled Required. Set to true to enable a network access policy. 
 access_type Required. The network access policy to apply to your Hyper Protect Crypto Services instance. Acceptable values are public-and-private or private-only. After the network access policy is set to private-only, you cannot access your instance from the public network and cannot view or manage keys with the IBM Cloud console. However, you can still adjust the network setting later using the API or CLI. 



A successful request returns an HTTP 204 No Content response, which indicates that your Hyper Protect Crypto Services instance now enforces a network access policy. API requests to the service are restricted to the policy that you set.

This policy applies to Hyper Protect Crypto Services instances only.
But, using @appliance:(air conditioner) gets expanded to entity['appliance'].contains('air conditioner'), which matches whenever there is at least one @appliance entity of value 'air conditioner' detected in the user input.
* Hiding data from the log: You can prevent information from being stored in Watson logs by storing it in a context variable and nesting the context variable within the $private section of the message context. For example: $private.my_info. Storing data in the private object hides it from the logs only. The information is still stored in the underlying JSON object. Do not allow this information to be exposed to the client application.
* Checking for personal information: If you want to check for and prevent a user from submitting personally identifiable information (PII) to some later process, you can add a dialog node that conditions on a pattern entity. Place the node at the beginning of the dialog tree to ensure that it checks the input first. For example, the entity could check for US Social Security number patterns or email address patterns. It can then respond with something like, Please do not submit personally identifiable information. Can you reenter your request? You can optionally reset the context to ensure that the user-submitted information with PII is not retained.







 Condition usage tips 



* Checking for values with special characters: If you want to check whether an entity or context variable contains a value, and the value includes a special character, such as an apostrophe ('), then you must surround the value that you want to check with parentheses. For example, to check if an entity or context variable contains the name O'Reilly, you must surround the name with parentheses.

@person:(O'Reilly) and $person:(O'Reilly)

Your assistant converts these shorthand references into these full SpEL expressions:

entities['person']?.contains('O''Reilly') and context['person'] == 'O''Reilly'

SpEL uses a second apostrophe to escape the single apostrophe in the name.
Anonymous authentication 

With IBM Cloud® App ID, you can allow users to anonymously browse your application under an anonymous user profile. If the user chooses to sign in, you can allow them to still access their anonymous attributes by attaching their anonymous profile to their user identity with App ID.



 Understanding progressive authentication 

When a user chooses not to sign in immediately, they are considered an anonymous user. For example, say you're an online retailer and you want to allow users to add objects to their shopping cart without signing in. However, you ask them to sign in to complete their purchase. If a user chooses to sign in, you can allow them to access the same objects that were in their shopping carts before they signed in.

You can use App ID to gather information about anonymous users into an anonymous user profile, which you can use to help personalize their experience of your application. If the user chooses to signs in, you can attach the user attributes that are part of the anonymous profile to their user identity that is stored in App ID. Anonymous profiles are temporarily valid. While you develop your app, you can [configure the lifetime](https://cloud.ibm.com/docs/appid?topic=appid-managing-idpidp-token-lifetime) of anonymous tokens.

When a user signs in, they become an identified user. If an existing identified user profile does not exist, you can create a new identified user profile. After a user is identified, App ID issues new access and identity tokens and their anonymous token becomes invalid. However, an identified user can still access the attributes of their anonymous profile because they are accessible with the new access and identity tokens.

You can attach the attributes of only one anonymous profile to the user's identity that is stored in App ID. For example, say that a user browses your application anonymously in two separate browser tabs. The user adds a t-shirt to the shopping cart on the first tab and a pair of shorts to the cart on the second tab. App ID creates two separate anonymous profiles to track the interactions of the user with your application on each tab.
AC-11 (1) - Pattern-hiding Displays 



  Control requirements 

AC-11 (1) - 0
:   The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  IBM Cloud console conceals information previously visible on the display when the user has been signed out due to inactivity







  NIST supplemental guidance 

Publicly viewable images can include static or dynamic images, for example, patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen, with the additional caveat that none of the images convey sensitive information.
: If you have Manager IAM access permissions, you can now use the Key Protect UI to create a metrics policy that allows you to view the operational metrics for your Key Protect instance. To find out more, see [Managing metrics](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-monitor-metricsenable-metrics-instance-policy-ui).





 01 December 2020 

Announcing support for key aliases
: If you have Writer or Manager access permissions, you can now use the Key Protect REST API to create a key alias. You can use a key alias to refer to a key in your Key Protect service instance. To find out more, see [Creating key aliases](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-key-alias).







 October 2020 



 20 October 2020 

Announcing Quantum Safe Cryptography
: In preparation for the post-quantum era, you can use a quantum safe enabled TLS connection to secure your communication to the IBM® Key Protect for IBM Cloud® service. To find out more, see [Using Quantum Safe Cryptography](https://cloud.ibm.com/docs/key-protect?topic=key-protect-quantum-safe-cryptography-tls-introduction).





 12 October 2020 

Key Protect adds access policy UI support
: You can set a key creation and importation policy, in the [user interface (UI)](https://cloud.ibm.com/login/), to restrict how keys are created and imported into your Key Protect service instance. See the updated "Instance policies" pane in the Key Protect UI.







 September 2020 



 17 September 2020 

Key Protect adds access policy API support
: You can set a key creation and importation policy, using the [API](https://cloud.ibm.com/apidocs/key-protect), to restrict how keys are created and imported into your Key Protect service instance.
For example, if the private endpoint port associated with your allowed IP policy is 8888, the endpoint that you will make a request through to list the keys in your Key Protect instance is https://private.us-south.kms.cloud.ibm.com:8888/api/v2/keys.

When making a request through a private network, the allowed IP policy will only consider the private network's gateway address, and not the IP address of the requester. Therefore, it is important that you add the IPv4 address associated with the private network gateway to your Key Protect instance's allowed IP policy.

You can use the following example request to retrieve a list of keys for your Key Protect instance via a private endpoint.

$ curl --ipv4 -X GET "https://private.<region>.kms.cloud.ibm.com:<private_endpoint_port>/api/v2/keys" -H "accept: application/vnd.ibm.kms.key+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>"

Replace the variables in your request according to the following table.



Table 4. Describes the variables needed to make a list keys request through a private endpoint on an instance with an allowed IP policy.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 private_endpoint_port Required. The port associated with an instance with an allowed IP policy. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. <br> <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token).