vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Key features of IBM Cloud Security and Compliance Center Workload Protection 

IBM Cloud® Security and Compliance Center Workload Protection offers functionality to protect workloads, get deep cloud and container visibility, posture management (compliance, benchmarks, CIEM), vulnerability scanning, forensics, and threat detection and blocking.



 Provides a unified and centralized framework to manage the security and compliance of applications, workloads and infrastructure 



* Provides a unified and centralized framework to manage the security and compliance of applications, workloads and infrastructure and protect workloads and resources that run on IBM Cloud, in other clouds, and on-prem. Presents relevant performance and security data in one location.
* Is built on open standards for cloud native security and control, including Falco, the open source standard for cloud threat detection, and Open Policy Agent (OPA), the open source standard for policy-as-code.
* Offers a workload protection platform (WPP) that focuses on management and security controls for workloads.
* Offers a compliance platform (CP) that focuses on management and compliance controls that are required to meet industry standards and laws.
* Includes Cloud security posture management (CSPM) to help you secure the infrastructure where workloads are deployed.
* Includes Kubernetes Security Posture Management (KSPM) to help you secure Kubernetes clusters or Openshift clusters, and the workloads running within it.
* Offers alerting on violations, and assists with remediation tasks.







 Offers host and image scanning, auditing, and runtime vulnerability management capabilities 



* Filters and surfaces vulnerabilities in images, clusters, namespaces, or hosts.
* Alerts on unscanned images or images when the evaluation status changes with new vulnerabilities.
* Logs user actions, container activity, and command arguments.
* Enforces security policies and blocks attacks.







 Provides posture management for a distributed environment 



* Schedules customized benchmark tests to run across cloud, hosts, services, or clusters.
* Controls compliance at cloud, orchestrator, and container level.
* Tracks and optimizes cloud users permissions and entitlements.
* Exports results to SIEM, logging clusters, or other tools.







 Provides runtime detection and data enrichment
Learning about Workload Protection architecture and workload isolation 

Review the following sample architecture for IBM Cloud Security and Compliance Center Workload Protection, and learn more about the workload isolation level that the service offers in the cloud.



 IBM Cloud Security and Compliance Center Workload Protection architecture 

IBM Cloud Security and Compliance Center Workload Protection is a highly available, multi-tenant, regional service that is available in IBM Cloud. You can use it to find and prioritize software vulnerabilities, detect and respond to threats, and manage configurations, permissions and compliance from source to run.

Zoom

![IBM Cloud Security and Compliance Center Workload Protection](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection/images/Monitoring-arch.svg)

Figure 1. Workload Protection Architecture

The API server component provides a web and an API interface to the service.

The collector component ingests data that agents forward to the service.

The data store component stores all results, metadata, instance credentials, and environmental data.

An agent connects to one instance. The agent forwards data to the instance that is connected.

The UI is the front-end component where users can monitor and configure scans, postures, policies, and alerts.





 Workload Protection workload isolation 

Each regional deployment of the IBM Cloud Security and Compliance Center Workload Protection service serves multiple tenants that are identified by the IBM service instance.



* A region that is responsible for running user workloads in the region has one deployment of the Workload Protection service in the region.
* The Workload Protection service in a region is [highly available](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-ha-dr).
* The data that is collected and processed by the Workload Protection service is associated with the instance and not visible to the other service instances by virtue of this association.
* Data for all tenants is located in the same data stores and segmented by the tenant-specific metric tags that are associated with each metric to enforce access control policies.
SI-2 (b) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain passes unit tests to validate all code changes<br> * Check whether DevSecOps Toolchain passes acceptance tests to validate every deployment<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br> 
 SI-2 (c) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br>
SI-2 (c) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br> 
 SI-2 (d) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts<br> * Check whether DevSecOps Toolchain passes unit tests to validate all code changes<br> * Check whether DevSecOps Toolchain passes acceptance tests to validate every deployment<br> * Check whether DevSecOps Toolchain signs build artifacts to attest their provenance<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br>
* [SAP Note 171380 - Released IBM hardware (Intel processors) and IBM cloud services offers](https://launchpad.support.sap.com//notes/171380)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)



This document is referenced by:



* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2588225 - SAP on IBM Cloud: Protect against speculative execution vulnerabilities](https://launchpad.support.sap.com//notes/2588225)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [Development processes and software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-development-processes)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for SA-3 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 SA-3 (a) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether Container Registry image pushes and pulls take place only over private endpoints<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts<br> * Check whether DevSecOps Toolchain signs build artifacts to attest their provenance<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br>
Getting started with IBM Cloud Data Security Broker 

IBM Cloud Data Security Broker is available as a Beta version, for evaluation and testing purposes. It is not intended for production usage.

Protect your data in the cloud with the IBM Cloud Data Security Broker, which is a complete data protection solution that secures sensitive data in enterprise databases by integrating with key management and databases to provide application-level encryption.

Data Security Broker offers Data Protection Services which consists of two main components, namely:

Data Security Broker Manager is the administrative console for the solution that integrates with enterprise key managers and databases and manages the Data Security Broker solution components.

Data Security Broker Shield is the SQL / NOSQL proxy that functions to encrypt and decrypt data at the field or record level.

Data Security Broker Manager enforces encryption policies and configurations by:



* Communicating with key management solutions, the Data Security Broker Shield, and databases.
* Orchestrating configuration and deployment.



Data Security Broker Shield is a stateless reverse proxy that intercepts and encrypts application data sent to the database and decrypts encrypted data returned by the database.

Data Security Broker offers Data Protection Services which provide a range of data protection services such as data encryption, data tokenization, record level encryption, and data masking.

Data Security Broker supports only PostgreSQL database.



 Before you begin 

Before you begin installing and configuring the Data Security Broker, ensure that you have met the following requirements:



* Create an IBM Cloud account.
* Set up your environment.
* Set up the minimum permissions required in the IBM Cloud account.





 Setting up your environment 

Ensure that your environment meets the following minimum system level and resource level requirements:



Table 1. Resource level requirements for Data Security Broker

 Cluster Operating System Number of Worker nodes required 

 Red Hat® OpenShift® cluster RHEL7/RHEL8 and CoreOS 2 
 IBM Cloud Kubernetes cluster Ubuntu 18 2 









 Data Security Broker Manager and Data Security Broker Shield Sizing Guidelines 

The factors that affect the sizing of the Data Security Broker deployments consist of the Data Security Broker Manager management console and one or more Data Security Broker Shield proxies. Each component has its own resource needs depending on the anticipated workloads.
* [SAP Note 2369910 - SAP Software on Linux®: General information](https://launchpad.support.sap.com//notes/2369910)
* [SAP Note 171380 - Released IBM hardware (Intel processors) and IBM cloud services offers](https://launchpad.support.sap.com//notes/171380)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)



This document is referenced by:



* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2588225 - SAP on IBM Cloud: Protect against speculative execution vulnerabilities](https://launchpad.support.sap.com//notes/2588225)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
CM-4 - Security Impact Analysis 



  Control requirements 

CM-4 - 0
:   The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities
*  Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies
*  Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely
*  Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts
*  Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities
*  Check whether DevSecOps Toolchain source code contains no secrets
*  Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code
*  Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis







  NIST supplemental guidance 

Organizational personnel with information security responsibilities (e.g., Information System Administrators, Information System Security Officers, Information System Security Managers, and Information System Security Engineers) conduct security impact analyses. Individuals conducting security impact analyses possess the necessary skills/technical expertise to analyze the changes to information systems and the associated security ramifications. Security impact analysis may include, for example, reviewing security plans to understand security control requirements and reviewing system design documentation to understand control implementation and how specific changes might affect the controls. Security impact analyses may also include assessments of risk to better understand the impact of the changes and to determine if additional security controls are required. Security impact analyses are scaled in accordance with the security categories of the information systems.
When you visit the Security and Compliance Center dashboard, three graphical representations of data are aggregated from your scans. The following data is displayed:

Success rate
: The rate at which your configurations pass the evaluation that is conducted.

The number of evaluations conducted does not always match the number of billable evaluations, as there is no charge for assessments evaluated as unable to perform. Be sure to look for the billable evaluations in each scan result if you need to estimate your cost.

Total controls
: The total number of controls that have been evaluated in the past 30 days.

Total evaluations
: The total number of evaluations that have been run in the past 30 days. An evaluation is the check of one resource against one assessment.

For more information, see [Viewing detailed results in the dashboard](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-results&interface=uiview-detailed-results).





 Finding existing integrations 

To find out if you already have a Workload Protection integration registered with the Security and Compliance Center, complete these steps:



1. In the IBM Cloud console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/a6478671e8f845a84102d9cf49bf28ee7f4f3227/icons/icon_hamburger.svg)> Security and Compliance to access the Security and Compliance Center.
2. In the navigation, click Integrations.
3. On the Integrations page, click the Connected tab. Any existing Workload Protection integrations are listed.
4. Click Dashboard URL to open your Workload Protection instance.
* Proxy user name - If you require proxy authentication, enter the username of the proxy server.
* Proxy password - If you require proxy authentication, enter the password of the proxy server.







 Deployment size 

IBM Cloud® provides the following deployment size options. For deployment on a multizone instance, only FortiGate-VM16 and FortiGate-VM32 are available.



* FortiGate-VM02 (2 vCPUs)
* FortiGate-VM04 (4 vCPUs)
* FortiGate-VM08 (8 vCPUs)
* FortiGate-VM16 (16 vCPUs)
* FortiGate-VM32 (32 vCPUs) The FortiGate-VM32 deployment size requires Cascade Lake 5218 or higher.







 Monthly subscription license model 

The monthly subscription license model for FortiGate Virtual Appliance offers the following options:



* Standard FW - This bundle includes the following.



* Stateful packet inspection
* VLAN protection and advanced logging
* Ingress and egress FW rules
* SSL/IPsec VPN termination
* Continuous support



* Standard FW + UTM - This bundle includes all standard firewall services in addition to the Advanced Malware Protection (AMP) service.



* Advanced malware protection
* NGFW IPS and web filtering
* Antispam
* Application control



* Standard FW + Enterprise This bundle includes all standard firewall and UTM services in addition to the following services:



* CASB (Cloud Access Security Broker) - This service provides visibility, compliance, data security, and threat protection for cloud-based services.
* Industrial security - This service provides signatures for common ICS/SCADA protocols.
* Security rating - This service provides audit capabilities to identify critical vulnerabilities and configuration weaknesses and implement best practice recommendations.





You can't change the monthly subscription license model after service installation. To change the monthly subscription license model, you must delete the existing service and reinstall the service by selecting a different license option.







 Related links
CM-3 (2) - Test / Validate / Document Changes 



 Control requirements 

CM-3 (2) - 0
: The organization tests, validates, and documents changes to the information system before implementing the changes on the operational system.





 Additional IBM Cloud for Financial Services specifications 



* Test programs, scripts, or code must not be placed into customer environments.







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities
* Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies
* Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely
* Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts
* Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities
* Check whether DevSecOps Toolchain source code contains no secrets
* Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code
* Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts
* Check whether DevSecOps Toolchain passes unit tests to validate all code changes
* Check whether Toolchain is configured only with the allowed integration tools
* Check whether DevSecOps Toolchain passes acceptance tests to validate every deployment
* Check whether DevSecOps Toolchain signs build artifacts to attest their provenance
* Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis







 NIST supplemental guidance 

Changes to information systems include modifications to hardware, software, or firmware components and configuration settings defined in CM-6. Organizations ensure that testing does not interfere with information system operations.