vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Secrets Manager also uses the following security mechanisms to protect your data in transit.



* TLS 1.2+ for end to end communications
* mTLS for internal communications
* Web App Firewall and DDoS protection
* Ingress and Egress network rules to isolate your dedicated instance







 Protecting your sensitive data in Secrets Manager 

You can add a higher level of encryption control to your data at rest (when it is stored) by enabling integration with a key management service.

The data that you store in IBM Cloud is encrypted at rest by using

envelope encryption. If you need to control the encryption keys, you can integrate a key management service. These processes are commonly referred to as Bring Your Own Keys (BYOK) or Keep Your Own Keys (KYOK). With a key management service, you can create, import, and manage encryption keys. You can assign access policies to the keys, assign users or service IDs to the keys, or give the key access only to a specific service.

The following table describes your options for managing the encryption of your Secrets Manager data.



Table 1. Encryption options for Secrets Manager

 Encryption Description 

 Provider-managed encryption The data that you store in Secrets Manager is encrypted at rest by using an IBM-managed key. The encryption key is stored in [Key Protect](https://cloud.ibm.com/catalog/services/key-protect). This setting is by default. 
 Customer-managed encryption The data that is stored in Secrets Manager is encrypted at rest by using an encryption key that you own and manage. You can use a root key that you manage in [Key Protect](https://cloud.ibm.com/catalog/services/key-protect) or [Hyper Protect Crypto Services](https://cloud.ibm.com/catalog/services/hs-crypto). 





 About customer-managed keys 

Secrets Manager uses envelope encryption to implement customer-managed keys. Envelope encryption describes encrypting one encryption key with another encryption key. The key used to encrypt the actual data is known as a

data encryption key (DEK).
IBM Cloud offers many different services that you can use with your server including, Evault, SNMP and Nagios monitoring. These services require that IBM's internal systems communicate with your server to some degree. The disabled ports you see in the Exceptions list are ports open on the internal network port only. They are still blocked on the public (internet) network connection. Since the internal network is a secured network, having these ports open is considered secure.

These ports generally cannot be modified; however, if you reset the firewall rules, the ports are cleared from the Exceptions list. Be aware that resetting the firewall rules can have an adverse effect on these additional services and can cause other issues as well depending on your server configuration.
* What IP ranges do I allow through the firewall?

For the list of IP addresses and IP ranges to allow through the firewall, go [here](https://cloud.ibm.com/docs/hardware-firewall-shared?topic=hardware-firewall-shared-ibm-cloud-ip-ranges).
* What is the maximum number of servers that the FortiGate Security Appliance 1 Gbps will protect?

The FortiGate Security Appliance 1 Gbps can protect every server on a Public VLAN. However it is important to note that since these firewall devices are connected with 2 Gbps Uplink, IBM recommends scaling the number of firewall instances to meet the performance needs of your application. You can do so by deploying extra public VLAN Firewalls within a pod to allow for additional firewall and associated compute resources to be added.
* What VPN options are included with each Firewall product?

Not all firewalls offer VPN and not all VPN options are the same. The general options for VPN are:



* Each customer receives unlimited SSL VPN connections to IBM's private network. These connections can be established by clicking the VPN link at the top of the page while logged in to the Cloud Catalog console.
* IBM Cloud also offers a basic multi-tenant IPsec VPN service.
* The FortiGate Security Appliance 1 Gbps provides SSL and IPsec VPN options with Public network access only (no access to the IBM Cloud private network).
After you complete these steps, the secure network management agent starts listening on the specified network port and is ready to accept requests from the secure network management CLI. These tasks can be done manually after connecting to the Hyper Protect Virtual Servers instance by using SSH, or when creating a container image in the case of BYOI.

To prevent any malicious access, consider the following recommendations to control access to the Hyper Protect Virtual Server:



* The secure network management agent binary and configuration files are highly sensitive and should never be exposed or altered. It is your responsibility to control access to the Hyper Protect Virtual Server.
* Disable SSH access for your production environment when you have highly sensitive workloads. When you need to grant SSH access to the Hyper Protect Virtual Server to multiple users, you must control the permissions of SSH users, and configure the Hyper Protect Virtual Server file system permission to allow only designated users to access the secure network management agent binary and all configuration files, and prevent any other users from having any read, write, or execute on these files.
* It is your responsibility to keep the SSH private key secure, if SSH is enabled for the Hyper Protect Virtual Server.



To prevent malicious access to the desktop that you used to set up and configure the secure network management, consider the following recommendations:



* You must download and install the secure network management agent only from this [Github repository](https://github.com/ibm-hyper-protect/secure-network/releases/tag/v2.0.0), with the correct signature provided by IBM. Do not install any programs from any other address that does not have the correct signature from IBM, as it might be malicious and can cause potential attacks on the virtual server.
* It is your responsibility to keep your desktop secure.
* It is your responsibility to encrypt the admin private key and keep it secure.









 Step 2: Configuring the audit log 

Complete the following to configure Log Analysis to trace audit logs:



1. Create a LogDNA service instance



* Create a logging service in the production environment in the us-south region.
* Get the ingestion key.
Security 



 Client Security Concerns 

Should a customer suspect a Cyber Security issue with their system, client should open a Severity 1 case containing as much detail as possible.





 Client Security Questionnaires 

Before submitting questionnaires, IBMers and clients should first refer to the security information, links and certifications that are available on this page. Existing customers who need a security questionnaire or assessment completed should submit a case to the IBM Support Community Portal and attach the document or link. This will be routed to the proper SRE security resource for review / completion. Please note there is a 2-3 week turnaround time required for the SRE security team to respond to client provided security forms or questionnaires; additional time may also be required for Watson IoT Security team review

Although IBM will fill out security questionairres as above, client led audit of the MAS SaaS offering is not supported or allowed. This includes onsite audit visits or performing validation tasks for individual clients. IBM will provide certifications as below only.





 Security Management 

IBM maintains and follows standard mandatory employment verification requirements for all hires. In accordance with IBM internal process and procedures, these requirements are periodically reviewed and include, but may not be limited to, criminal background check, proof of identity validation, and additional checks as deemed necessary by IBM.



* All IBMers are required to complete mandatory Cyber Security & Privacy training annually
* All IBMers are required to complete GDPR training annually
* All IBMers are required to complete mandatory Business Conduct Guidelines training annually
* Only IBM Maximo Application Suite SaaS personnel are permitted access to customer systems
* IBM Maximo Application Suite SaaS SRE personnel are required to use privileged access workstations to connect and work with our customer's IBM systems. These workstations meet IBM's highest and most stringent security guidelines.



IBM Maximo Application Suite SaaS SRE personnel who are granted O/S or console level access to customer servers are required to use multi-factor authentication. Unique 2048-bit ssh keys are issued to each IBM user in order to connect to the IBM Cloud VPN. Phone based authentication via PIN is also required each time an IBMer connects.
You are responsible for the security and compliance of your application data.



Table 4. Responsibilities for security and regulation compliance

 Task IBM Responsibilities Your Responsibilities 

 Applications Maintain controls that are commensurate to [various industry compliance standards](https://cloud.ibm.com/docs/key-protect?topic=key-protect-security-and-compliancecompliance-ready), such as SOC and ISO. Set up and maintain security and regulation compliance for your apps and data. For example, you can enable extra security settings to meet your compliance needs by choosing how and when to [import](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keysplan-ahead), [wrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keys), [rotate](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keysplan-ahead), [rewrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rewrap-keys), and [delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) keys. 







 Disaster recovery 

IBM is responsible for the recovery of IBM Key Protect components in case of disaster.

You are responsible for the recovery of the workloads that run Key Protect and your application data.



Table 5. Responsibilities for disaster recovery

 Task IBM Responsibilities Your Responsibilities 

 Applications Continuously back up keys in the region that the service operates in, and automatically recover and restart service components after any disaster event. None. IBM and Key Protect are fully responsible for managing disaster recovery. 
 Virtual Private Endpoints (VPE) VPE does not support automatically switching to backup during failover at this time. VPE settings, specifically the Internet Protocol (IP) address, need to be manually updated during disaster recovery procedures. 
 Private Endpoint (PE) PE will not support allowed IP settings during disaster recovery at this time, but an announcement on this topic will be made soon.
Data security and encryption 

The IBM® Db2® on Cloud service has security built into all levels of its architecture.

The following methods are used to secure your data:



*  The default keys are managed by [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keys). Bring-your-own-key [(BYOK)](https://cloud.ibm.com/docs/Db2onCloud?topic=Db2onCloud-key-protect-v2) for encryption is also available through Key Protect integration.
*  Backups are encrypted.
*  Data in motion is encrypted through SSL/TLS. The current supported version of this encryption is TLS 1.2.
*  All Db2 on Cloud storage is provided on storage encrypted by using AES-256 encryption.
*  Backplane network connectivity is supported through IBM Cloud® Service Endpoints
*  Database-level security is supported through Role-Based Access Control (RBAC) and Row and Column Access Control (RCAC)



Administrators can make encrypted connections mandatory. For more information, see [SSL connectivity](https://cloud.ibm.com/docs/Db2onCloud?topic=Db2onCloud-ssl_support).
Access Control (AC) [AC-16 Security Attributes](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-16) 
 System and Communications Protection (SC) [SC-16 Transmission of Security Attributes](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-16) 







 18. Monitor for security and compliance against a baseline configuration 

Requirement: Deploy and use tooling for monitoring and reporting of security and compliance. Maintain a baseline configuration for your service that consists of automated mechanisms to facilitate information system baseline management.

With [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started) you can embed security checks into your every day workflows to help monitor for security and compliance. By monitoring for risks, you can identify security vulnerabilities and quickly work to mitigate the impact and fix the issue. By using Security and Compliance Center along with [external integrations](https://cloud.ibm.com/security-compliance/integrations) (such as, OpenShift Compliance Operator (OSCO), Tanium, NeuVector, and so on), you can build a robust approach for monitoring for security and compliance issues.

Purpose & value: Continuous monitoring and reporting helps detect malicious activity and security vulnerabilities as early as possible. Automated baseline management makes it much more likely that any compliance-breaking changes to your system configurations are caught early.

Implementation guidance:



* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance)



Most Relevant Controls:



Table 18. Related controls for monitoring security and compliance

 Family Control
Cyber Recovery overview 

The most critical aspects of your organization are your computer systems and networks and your data. You must protect them from threats.

Cyber resilience is the ability to avert, handle, and recover from various incidents that can damage or compromise your data or systems. You must be able to continue to provide your operations to your users. For more information, see [What is cyber resilience](https://www.ibm.com/topics/cyber-resilience).

Cyber Recovery can help protect your data from cyberthreats, cyberattacks, and ransomware. A Cyber Recovery instance includes Veeam Backup and Replication 12, a Linux® hardened repository (LHR), and an edge gateway.

For the edge gateway, you can bring your own gateway appliance or choose from the following options:



*  Gateway cluster with Juniper® vSRX
*  Gateway cluster with FortiGate® Virtual Appliance
*  FortiGate Security Appliance



VMware vSphere® 7.0u3 and VMware NSX-T™ 3.2 are automatically installed.

The offering is for a single-zone VMware instance only.

When you install Cyber Recovery, the Veeam add-on service and the add-on service that you choose as your firewall appliance are automatically included. When you edit Veeam to configure it, the Linux hardened repository is required and already selected.



  Related links 



*  [Planning for Cyber Recovery](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-cr_planning)
*  [Requirements for Cyber Recovery](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-cr_orderinginstance_reqs)
SC-1 - System and Communications Protection Policy and Procedures 



  Control requirements 

The organization:

SC-1 (a)
:   Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:



1.  A system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2.  Procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls; and



SC-1 (b)
:   Reviews and updates the current:



1.  System and communications protection policy [IBM Assignment: at least annually]; and
2.  System and communications protection procedures [IBM Assignment: at least annually].







  NIST supplemental guidance 

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the SC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.
You can



* view encryption details. Encryption at rest is enabled for all Databases for Elasticsearch deployments. If you brought your own encryption key from [Key Protect](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-key-protect), the panel provides a link to your Key Protect instance and the Encryption Key field has the name of the key.
* [Change the admin password](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-admin-password)
* [Implement or modify an IP allowlist](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-allowlisting)







 Service Credentials 

You can generate a new set of credentials for cases where you want to manually [connect an app](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-ibmcloud-app) or [external consumer](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-external-app) to an IBM Cloud service. For more information, see [Adding and viewing credentials](https://cloud.ibm.com/docs/account?topic=account-service_credentials).





 Connections 

Shows connected resources. You can use the Create connection button to bind this service to another resource.





 View docs 

The View docs link from the Actions drop list opens the main documentation page for Databases for Elasticsearch in a new tab.
PM-11 - Mission/business Process Definition 



  Control requirements 

The organization:

PM-11 (a)
:   Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and

PM-11 (b)
:   Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained.
Secrets in particular can take up a lot of storage on the local node, so plan accordingly.

Both resources define key-value pairs, but you use them for different situations.

Configmap
: Provide non-sensitive configuration information for workloads that are specified in a deployment. You can use configmaps in three main ways.



* File system: You can mount an entire file or a set of variables to a pod. A file is created for each entry based on the key name contents of the file that are set to the value.
* Environment variable: Dynamically set the environment variable for a container spec.
* Command-line option: Set the command-line option that is used in a container spec.



Secret
: Provide sensitive information to your workloads, such as follows. Other users of the cluster might have access to the secret, so be sure that you know the secret information can be shared with those users.



* Personally identifiable information (PII: Store sensitive information such as email addresses or other types of information that are required for company compliance or government regulation in secrets.
* Credentials: Put credentials such as passwords, keys, and tokens in a secret to reduce the risk of accidental exposure. For example, when you [bind a service](https://cloud.ibm.com/docs/containers?topic=containers-service-binding) to your cluster, the credentials are stored in a secret.



Want to make your secrets even more secured? Ask your cluster admin to [enable a key management service provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) in your cluster to encrypt new and existing secrets.





 How can I make sure that my app has the correct resources? 

When you [specify your app YAML file](https://cloud.ibm.com/docs/containers?topic=containers-appapp_yaml), you can add Kubernetes functionalities to your app configuration that help your app get the correct resources.
To protect against natural or man-made disasters that might destroy an entire Availability Zone, consider storing your most important data in multiple locations. For more information, see [Understanding high availability and disaster recovery](https://cloud.ibm.com/docs/vpc?topic=vpc-ha-dr-vpc).





 High Availability 

VPC storage is built upon best-in-class, proven, enterprise-grade hardware and software to ensure high availability and uptime. The data is stored redundantly across multiple physical disks on HA paired nodes. Each storage node has multiple paths to its own Solid-State Drives and its partner node's SSDs as well. This configuration protects against path failure and controller failure because the node can still access its partner's disks for continued productivity. Redundant network ports and paths protect against network failures across the cloud connections. For more information, see [Understanding high availability and disaster recovery](https://cloud.ibm.com/docs/vpc?topic=vpc-ha-dr-vpc).





 Encryption 

IBM Cloud® provides full-disk encryption without compromising storage application performance. For more information about provider- and customer-managed encryption, see [About data encryption for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-about).