vania-janet/multiturn-rag-retrieval-data huggingface dataset:
RA-5 (b) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s)<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br><br><br> 
 RA-5 (c) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain passes acceptance tests to validate every deployment<br><br><br>
13 March 2023 

The following new controls have been added to the IBM Cloud Security Best Practices library and profile as of 17 March 2023.



Table. Summary of IBM Cloud Security Best Practices profile changes for Version 1.1.0

 Control ID Control Description 

 6.1 Ensure Toolchain scans during continuous integration the source code to identify vulnerabilities 
 6.2 Ensure Toolchain has unit tests that are continuously run to validate source code changes 
 6.3 Ensure Toolchain has Code Risk Analyzer configured that collects a bill of materials for pipeline run 
 6.4 Ensure Toolchain is configured with image signing 
 6.5 Ensure Toolchain source code meets Center for Internet Security Docker benchmarks 
 6.6 Ensure Toolchain has branch protection rules enabled 
 6.7 Ensure Toolchain has secret detection scans enabled for source code 
 6.8 Ensure Toolchain production change request exists and is approved 
 6.9 Ensure Toolchain Container Registry Vulnerability Advisor scans images for OS vulnerability detection 
 6.12 Ensure Toolchain acceptance tests exist and have passed 
 6.16 Ensure that only the tool integrations within the toolchain are included in the allow list parameter array 
 6.17 Ensure a Toolchain static scan exists and has passed 
 6.18 Ensure a Toolchain dynamic scan exists and has passed 



The Toolchain controls that are listed in the table are configured to check DevSecOps Continuous Delivery (CD) and DevSecOps Continuous Compliance (CC) toolchains only, except for control 6.16, which is relevant to all toolchains. If you run an evaluation on a DevSecOps Continous Integration (CI) toolchain, or on any other toolchain that is not a DevSecOps toolchain, the result is returned as Unable to perform.







 Version 1.0.0 

The format of the IBM Cloud Security Best Practices profile has been updated with the following changes. Review your configuration closely to ensure that the profile still meets your needs.



* The profile is noq available on the Profiles page of the Manage section of the updated infrastructure.
* The format changed from being goal-based to assessment-based.
DevSecOps application lifecycle management 

The DevSecOps deployable architecture creates a set of DevOps Toolchains and pipelines. DevSecOps uses Continuous Delivery (Git Repos and Issue Tracking, Tekton Pipelines, DevOps Insights, and Code Risk Analyzer), Secrets Manager, Key Protect, Cloud Object Storage, Container Registry and Vulnerability Advisor.

Out of the box, DevSecOps also leverages popular scanning tools such as SonarQube, GoSec, OWASP Zap (dynamic scan), any unit test framework, and GPG signing. It can also be used with more tools such as external Git providers and artifact stores. DevSecOps supports hybrid deployments, in particular by using private pipeline workers, and can be interfaced with other deployment tools such as Satellite Config.

For more details on DevSecOps with Continuous Delivery. See this topic: [DevSecOps with Continuous Delivery](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops_intro)



 Architecture diagram 

Zoom

![DevSecOps Application Lifecycle Management Arch Diagram](https://cloud.ibm.com/docs-content/v1/content/9610604e9f8dcd5f7b6b138dd22ba445300be7f5/deployable-reference-architectures/terraform-ibm-devsecops-alm/diagram-deploy-arch-ibm-devsecops-alm-diagram.svg)

Figure 1. Architecture diagram for a set of DevSecOps CI/CD/CC toolchains using the Continuous Delivery service on IBM Cloud





 Design requirements 

Zoom

!
DevSecOps application lifecycle management 

The DevSecOps deployable architecture creates a set of DevOps Toolchains and pipelines. DevSecOps uses Continuous Delivery (Git Repos and Issue Tracking, Tekton Pipelines, DevOps Insights, and Code Risk Analyzer), Secrets Manager, Key Protect, Cloud Object Storage, Container Registry and Vulnerability Advisor.

Out of the box, DevSecOps also leverages popular scanning tools such as SonarQube, GoSec, OWASP Zap (dynamic scan), any unit test framework, and GPG signing. It can also be used with more tools such as external Git providers and artifact stores. DevSecOps supports hybrid deployments, in particular by using private pipeline workers, and can be interfaced with other deployment tools such as Satellite Config.

For more details on DevSecOps with Continuous Delivery. See this topic: [DevSecOps with Continuous Delivery](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops_intro)



 Architecture diagram 

Zoom

![DevSecOps Application Lifecycle Management Arch Diagram](https://cloud.ibm.com/docs-content/v1/content/880fa35b13cb9428675d718aa36ca2825b4c87c8/devsecops-alm/includes/deployable-reference-architectures/terraform-ibm-devsecops-alm/includes/deployable-reference-architectures/terraform-ibm-devsecops-alm/diagram-deploy-arch-ibm-devsecops-alm-diagram.svg)

Figure 1. Architecture diagram for a set of DevSecOps CI/CD/CC toolchains using the Continuous Delivery service on IBM Cloud





 Design requirements 

Zoom

!
* [New domain names](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes25feb2019_dns)
* [Adding IAM API key policies to control access to resources](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes25feb2019_secrets)
* [New region in ap-north](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes25feb2019_ap-north)



* [21 February 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-21feb2019)



* [Automating access to your namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes21feb2019_access)



* [8 January 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-8jan2019)



* [End of support for Vulnerability Advisor API version 2](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes8jan2019_va2)



* [4 October 2018](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-4oct2018)



* [Managing user access](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes4oct2018_access)



* [7 August 2018](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-7aug2018)



* [Exemption policies available in Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes7aug2018_exemption)
* [Change management](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_responsibilitieschange-management)
* [Identity and access management](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_responsibilitiesiam-responsibilities)
* [Security and regulation compliance](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_responsibilitiessecurity-compliance)
* [Disaster recovery](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_responsibilitiesdisaster-recovery)







 Terraform reference 

[Terraform reference](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cr_namespace)





 API reference 

[IBM Cloud Container Registry API](https://cloud.ibm.com/apidocs/container-registry)

[Vulnerability Advisor 3 for IBM Cloud Container Registry API](https://cloud.ibm.com/apidocs/container-registry/va)

[Vulnerability Advisor 4 for IBM Cloud Container Registry API](https://cloud.ibm.com/apidocs/container-registry/va-v4)





 Related links 

[IBM Cloud Kubernetes Service documentation](https://cloud.ibm.com/docs/containers?topic=containers-getting-started)

[Red Hat OpenShift on IBM Cloud documentation](https://cloud.ibm.com/docs/openshift?topic=openshift-getting-started)

[IBM Developer - Containers](https://developer.ibm.com/technologies/containers/)





 Troubleshooting 

[Troubleshooting](https://cloud.ibm.com/docs/Registry?topic=Registry-ts_indexts_index)



* [Troubleshooting topics](https://cloud.ibm.com/docs/Registry?topic=Registry-ts_indexgettinghelp_ts)
POST /api/v1/trash/{digest}/restoretags container-registry.image.push container-registry.trash.restore 
 Restore deleted image. POST /api/v1/trash/{image}/restore container-registry.image.push container-registry.trash.restore 









 Vulnerability Advisor API methods 



 Report API methods 



Table 11. Report

 Action Method IAM ACTION AT ACTION 

 Get the vulnerability assessment for all images. GET /va/api/v3/report/account container-registry.exemption.list container-registry.account-vulnerability-report.list 
 Get vulnerability assessment status for all images. GET /va/api/v3/report/account/status container-registry.exemption.list container-registry.account-vulnerability-status.list 
 Get vulnerability status. GET /va/api/v3/report/image/status/{name} container-registry.exemption.list container-registry.image-vulnerability-status.read 
 Get vulnerability assessment status. GET /va/api/v3/report/image/{name} container-registry.exemption.list container-registry.image-vulnerability-report.read 







 Exemption API methods 



Table 12. Exemption

 Action Method IAM ACTION AT ACTION 

 List account-level exemptions. GET /va/api/v3/exempt/image container-registry.exemption.list 
 Get an account-level exemption. GET /va/api/v3/exempt/image/issue/{issueType}/{issueID} container-registry.exemption.list 
 Create or update an account-level exemption. POST /va/api/v3/exempt/image/issue/{issueType}/{issueID} container-registry.exemption.manager container-registry.exemption.create 
 Delete an account-level exemption. DELETE /va/api/v3/exempt/image/issue/{issueType}/{issueID} container-registry.exemption.manager container-registry.exemption.delete 
 List resource exemptions. GET /va/api/v3/exempt/image/{resource} container-registry.exemption.list 
 Get details of a resource exemption.
See [Data encryption in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-in-transit) and [enable mTLS between containers](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-openshift-service-meshopenshift-service-mesh-secure_services) for more details.
* Implement gateways to specify which traffic you want to enter or leave the mesh (and deny all traffic by default). You can use an egress gateway to control/allowlist all necessary endpoints and domains that your application needs to connect to. For examples, see [Expose the app with the Istio Ingress Gateway and Route](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-openshift-service-meshopenshift-service-mesh-ingress_gateway_route) and [Perform traffic management](https://cloud.ibm.com/docs/docs/solution-tutorials?topic=solution-tutorials-openshift-service-meshopenshift-service-mesh-traffic_management)



5. Set up Container Registry and Vulnerability Advisor. For more information, see [Container Registry and Vulnerability Advisor](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-development-processesvpc-architecture-development-processes-registry-vulnerability-advisor).
6. Develop and deploy applications to your cluster. See the following for more details:



* [Planning app deployments](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_deploy) for more details.
* [Deploying applications on Red Hat OpenShift on IBM Cloud Service Mesh](https://docs.openshift.com/container-platform/4.5/service_mesh/v1x/prepare-to-deploy-applications-ossm.html)









 Related resources
For more information, see [Continuous integration pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-ci-pipeline).
* continuous deployment pipeline stages: setup, verify-artifact, deploy, acceptance-test, and finish. For more information, see [continuous deployment pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cd-pipeline).
* Continuous compliance pipeline stages: setup, static-scan, dynamic-scan, scan-artifact, and finish. For more information, see [Continuous compliance pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-cc-pipeline).





 Stage descriptions 



* setup: Run scripts to complete setup tasks that are done outside the pipeline run context. These tasks persist for the entire pipeline run. For example, setting up an external environment, setting up branch protection rules, performing health checks, checking environments, or initializing external services.
* test: Run unit tests, include all of your tests that run on your codebase, and pre-deploy time.
* static-scan: Run a static code analyzer tool.
* peer-review: Run scripts to check whether the pull request is reviewed and has the minimum number of required approvals.
* dynamic-scan: Run dynamic scan on the application.
* containerize: Create the artifacts that are required by your app, such as Docker images, RPMs, and Java Archive (JARS) files.
* scan-artifact: Scan the artifacts, for example, by using Container Registry Vulnerability Advisor for Docker images.
* sign-artifact: Sign the artifacts.
* release: Add artifacts to the inventory by marking them available for deployment.
* deploy: Deploy artifacts to an environment such as test and dev or staging and prod.
* acceptance-test: Run tests on deployed artifacts. You can also include your post-deployment tests in this stage.
* verify-artifact: Run scripts to check whether the artifacts that are signed in the CI pipeline have valid signatures.
SI-2 (2) - Automated Flaw Remediation Status 



  Control requirements 

SI-2 (2) - 0
:   The organization employs automated mechanisms [IBM Assignment: at least monthly] to determine the state of information system components with regard to flaw remediation.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Compliance monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance)







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities
*  Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies
*  Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s)
*  Check whether OpenShift worker nodes are updated to the latest image to ensure patching of vulnerabilities
*  Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely
*  Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts
*  Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities
*  Check whether DevSecOps Toolchain source code contains no secrets
*  Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code
*  Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts
*  Check whether DevSecOps Toolchain passes unit tests to validate all code changes
*  Check whether OpenShift version is up-to-date
*  Check whether DevSecOps Toolchain passes acceptance tests to validate every deployment
*  Check whether DevSecOps Toolchain signs build artifacts to attest their provenance
*  Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis
* [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for SI-2 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 SI-2 (a) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies<br> * Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s)<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts<br> * Check whether Event Notifications are configured for each of the supported Service<br> * Check whether DevSecOps Toolchain passes unit tests to validate all code changes<br> * Check whether DevSecOps Toolchain passes acceptance tests to validate every deployment<br> * Check whether DevSecOps Toolchain signs build artifacts to attest their provenance<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br>
Overview of DevSecOps Application Lifecycle Management deployable architecture 

The DevSecOps Application Lifecycle Management Deployable Architecture creates a set of DevOps toolchains and pipelines. DevSecOps uses continuous delivery (CD) (Git Repos and Issue Tracking, Tekton Pipelines, IBM Cloud® DevOps Insights, and Code Risk Analyzer), Secrets Manager, IBM® Key Protect, IBM Cloud® Object Storage, IBM Cloud® Container Registry, and Vulnerability Advisor.
Update the following line in the hello-world.yaml file by replacing <my_namespace> with your namespace:

image: us.icr.io/<my_namespace>/hello-world:1
4. Run your image as a deployment and expose it by creating a service that is accessed through the IP address of the worker node:

kubectl apply -f hello-world.yaml
5. Find the port that is used on the worker node by examining your new service by running the following command:

kubectl describe service hello-world

Note the number on the NodePort: line. Throughout this tutorial, use the number to replace the variable <node_port>.
6. In the output of the following command, note the public IP address. Throughout this tutorial, replace the variable <public_ip> with the IP address:

ibmcloud ks workers <my_cluster>
7. Access your service by running the following command. You can also use a web browser.

curl <public_ip>:<node_port>

If you see "Hello, world!", you're good to go.









 Step 2: Secure your images and clusters 

When you push an image to a namespace, the image is automatically scanned by [Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=ui) to find [potential vulnerabilities](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uitypes). If vulnerabilities are found, instructions are provided to help fix the reported vulnerabilities.

To demonstrate these features, you must push an intentionally vulnerable image.

Images are continually updated and new CVEs are discovered. As a result, you might see more vulnerabilities present in your image. If so, fix those vulnerabilities by using the information that is provided by Vulnerability Advisor.



 View the vulnerability report for your image
For more information, see [Continuous integration parameters](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipeline-parm).







 07 December 2022 

DevSecOps Continuous Integration for Infrastructure as Code is available as a Toolchain template in the Toolchain catalog. For more information, see [Develop and deploy secure IaC with DevSecOps practices](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-tutorial-iac).





 30 November 2022 



* CRA scans are now part of the app-preview-pr-listener in the CI pipeline.
* Cocoa Tekton get-pipeline-logs supports pulling logs for specific stages.
* Fixed malformed Git GraphQL URL for nonexistent target branch in the inventory repository.







 25 October 2022 



* CRA issue parser now contains an Introduced by field when creating a new issue found during a scan.
* Improved error logging to debug long running promotion requests in the CD pipeline.







 5 October 2022 



* Amber task support for pipelines to notify users that a pipeline has a non-fatal failure.
* Performance improvements in the CD pipeline change request flow.







 16 September 2022 



* Added the retry_sleep environment property for the number of Vulnerability Advisor (VA) scans to attempt for a pipeline run.
* Improved log messages so the evidence status is clearer. For example, Evaluated evidence status: <success|failure|pending>.







 11 August 2022 



* Use the native due date field in GitLab for managing issues.
* Added custom-exempt-label as an environment property that so pipelines are not marked as failed if they have the matching exempt label.
* Fixed Cloud Object Storage as an evidence locker for CC pipeline.







 25 July 2022 



* Upload Continuous Compliance evidence summary for Security and Compliance Center.







 24 June 2022 



* Enabled DevOps Insights integration for the continuous compliance (CC) template.