vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Configure a scheduled, encrypted backup of the Veeam Backup & Replication configuration and use a Veeam file copy job to copy the file to the protected region. This way, if a failure occurs, the Veeam Backup server can be rebuilt and the configuration can be restored from an off-site copy.
* A capacity tier that uses IBM Cloud Object Storage is not configured as the storage requirements for use case 1 are low.



The following guidance applies to use cases 2 and 3:



* Deploy more bare metal servers hosted on the workload cluster primary subnet to enable separation and scaling of backup repositories and allow better performance.
* For optimal performance and availability, placing the Veeam components on separate virtual and physical servers is considered best practice. Consider the use of a virtual machine for the Veeam Backup server as it provides high availability through vSphere HA. It also provides great flexibility in sizing and scaling as the environment grows.
* Microsoft SQL Server 2016 Express edition is included in the Veeam Backup & Replication standard installation. In environments with more than 500 protected VMs, consider the use of a different version of Microsoft SQL Server.
* For large storage requirements, it is recommended to not size volumes larger than 200 TB to keep failure domains small and manageable. For larger repositories, use a Scale-Out Backup Repository with multiple extents.
* The IBM Cloud Object Storage repository cannot be used on its own but can be configured as Capacity Tier in the Veeam Scale-out Backup Repository. Consider this type of repository for large deployments or for deployments with a large archive requirement.







 KMIP for VMware 

The Key Management Interoperability Protocol (KMIP) for VMware service provides a 24x7 highly available service to allow the interconnection of vCenter to the Hyper Protect Crypto Service. For more information about the encryption design in for VMware® Regulated Workloads, see [Encryption](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-encryption).

KMIP is a region-based service.
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) 









 What's in a secret? 

Secrets that you store with the service consist of metadata attributes and a secret value. While the metadata attributes help you to identify a secret, the secret value is the data that protected services need to authenticate and authorize you or your application.

Check out the following image to see how a secret is structured.

Zoom

!
1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Automated 1 Pass 
 1.2.31 Ensure that the --client-ca-file option is set as appropriate. Automated 1 Pass 
 1.2.32 Ensure that the --etcd-cafile option is set as appropriate. Automated 1 Pass 
 1.2.33 Ensure that the --encryption-provider-config option is set as appropriate. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 
 1.2.34 Ensure that encryption providers are appropriately configured. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Manual 1 Pass 







 1.3 Controller manager 



Section 1.3 Controller manager benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.3.1 Ensure that garbage collection is configured as appropriate. Manual 1 Not checked 
 1.3.2 Ensure that controller manager healthz endpoints are protected by RBAC. Automated 1 Missing 
 1.3.3 Ensure that the --use-service-account-credentials option is set to true. Automated 1 Pass 
 1.3.4 Ensure that the --service-account-private-key-file option is set as appropriate. Automated 1 Pass 
 1.3.5 Ensure that the --root-ca-file option is set as appropriate. Automated 1 Missing 
 1.3.6 Ensure that the RotateKubeletServerCertificate option is set to true. Automated 2 Pass 
 1.3.7 Ensure that the --bind-address option is set to 127.0.0.1. Automated 1 Pass 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results
Information security 

IBM is announcing the deprecation of the IBM Watson® Language Translator service for IBM Cloud® in all regions. As of 10 June 2023, the Language Translator tile will be removed from the IBM Cloud Platform for new customers; only existing customers will be able to access the product. As of 10 June 2024, the service will reach its End of Support date. As of 10 December 2024, the service will be withdrawn entirely and will no longer be available to any customers.

IBM is committed to providing our clients and partners with innovative data privacy, security and governance solutions.

Notice: Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that may affect the clients’ business and any actions the clients may need to take to comply with such laws and regulations.

The products, services, and other capabilities described herein are not suitable for all client situations and may have restricted availability. IBM does not provide legal, accounting or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation.

If you need to request GDPR support for IBM Cloud® Watson resources that are created



* In the European Union (EU), see [Requesting support for IBM Cloud Watson resources created in the European Union](https://cloud.ibm.com/docs/watson/getting-started-gdpr-sar.htmlrequest-EU).
* Outside of the EU, see [Requesting support for resources outside the European Union](https://cloud.ibm.com/docs/watson/getting-started-gdpr-sar.htmlrequest-non-EU).





 European Union General Data Protection Regulation (GDPR) 

IBM is committed to providing our clients and partners with innovative data privacy, security and governance solutions to assist them on their journey to GDPR compliance.

Learn more about IBM's own GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey [here](http://www.ibm.com/gdpr).





 Health Insurance Portability and Accountability Act (HIPAA)
* Consider setting the minimum scale to a single instance with the --min 1 option.



export SERVICE_NAME="myapp"
ibmcloud ce application create -n ${SERVICE_NAME} -v project -min 1 -p 8080 -i icr.io/codeengine/hello

Example output

Creating application 'myapp'...
[...]
Run 'ibmcloud ce application get -n myapp' to check the application status.
OK

http://myapp.p8abcd4abcd.svc.cluster.local





 Step 3: Finding the namespace and service URLs 

Extract information about your deployed application and about the project's Guard-Leaner.

export NAMESPACE=ibmcloud ce project current -o json|jq -r .kube_config_context
export GUARD_URL=ibmcloud ce application get -n guard-learner -o url
export SERVICE_URL=ibmcloud ce application get -n ${SERVICE_NAME} -o url

echo "The protected service name '${SERVICE_NAME}' namespace '${NAMESPACE}' url '${SERVICE_URL}'"
echo "The guard learner url is '${GUARD_URL}'"

Example output

The protected service name 'myapp' namespace 'p8abcd4abcd' url 'http://myapp.p8abcd4abcd.svc.cluster.local'
The guard learner url is 'http://guard-learner.p8abcd4abcd.svc.cluster.local'





 Step 4: Exposing the Hello World application to the internet through Guard 

Add a Hello World guard to securely expose the Hello World application to the internet.

ibmcloud ce application create -n ${SERVICE_NAME}-guard --min 1 -p 22000 
-e GUARD_URL=${GUARD_URL} 
-e SERVICE_URL=${SERVICE_URL} 
-e SERVICE_NAME=${SERVICE_NAME} 
-e NAMESPACE=${NAMESPACE}
Quick start: Liberty for Java backend apps 

With App ID, you can easily protect your API endpoints and ensure the security of your Liberty for Java backend applications. With the guide, you can quickly get a simple authentication flow up and running in less than 20 minutes.

Zoom

![Backend Liberty for Java apps](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/backend_liberty.png)

Figure 1. Backend Liberty for Java flow



1. To make a request to a protected resource, a client must have an access token. In step 1, the client makes a request to App ID for a token. For more information about obtaining access tokens, see [Obtaining tokens](https://cloud.ibm.com/docs/appid?topic=appid-obtain-tokens).
2. App ID returns the tokens.
3. Using the access token, the client makes a request to access the protected resource.
4. The resource validates the token that includes the structure, expiration, signature, audience, and any other present fields. If the token is not valid, the resource server denies access. If the token validation is successful, it returns the data.





 Video tutorial 

Check out the following video to see how you can use App ID to protect a simple Liberty for Java application. All the information that is covered in the video can also be found in written form on this page.

Don't have an app that you can try out the flow with? No problem! App ID provides a [simple Liberty for Java sample app](https://github.com/ibm-cloud-security/appid-video-tutorials/tree/master/02d-simple-liberty-backend-app).





 Before you begin 

Before you get started with App ID in your Liberty for Java back-end application, you must have the following prerequisites:
console.log(Add legal hold ${legalHoldId} to ${objectName} in bucket ${bucketName} with a putObject operation.);
return cos.putObject({
Bucket: bucketName,
Key: objectName,
Body: 'body',
RetentionLegalHoldId: legalHoldId
}).promise()
.then((data) => {
console.log(Legal hold ${legalHoldId} added to object ${objectName} in bucket ${bucketName});
})
.catch((e) => {
console.log(ERROR: ${e.code} - ${e.message}n);
});
}

function copyProtectedObject(sourceBucketName, sourceObjectName, destinationBucketName, newObjectName, ) {
console.log(Copy protected object ${sourceObjectName} from bucket ${sourceBucketName} to ${destinationBucketName}/${newObjectName}.);
return cos.copyObject({
Bucket: destinationBucketName,
Key: newObjectName,
CopySource: sourceBucketName + '/' + sourceObjectName,
RetentionDirective: 'Copy'
}).promise()
.then((data) => {
console.log(Protected object copied from ${sourceBucketName}/${sourceObjectName} to ${destinationBucketName}/${newObjectName});
})
.catch((e) => {
console.log(ERROR: ${e.code} - ${e.message}n);
});
}





 Add or remove a legal hold to or from an object 

This implementation of the POST operation uses the legalHold query parameter and add and remove query parameters to add or remove a single legal hold from a protected object in a protected bucket.

The object can support 100 legal holds:



* A legal hold identifier is a string of maximum length 64 characters and a minimum length of one character.
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/checkmark-icon.svg) 







 What targets should I use based on my compliance needs? 

There are two options available depending on your compliance needs:



* If you require Financial Services Validation.
* If you required PCI, SOC2, Privacy Shield and HIPAA compliance.





 Financial Services Validated status 

If you're the account owner, you can enable your IBM Cloud® account to be Financial Services Validated, which means your account stores and manages regulated financial services information. Services that are designated as IBM Cloud for Financial Services Validated leverage the industry’s highest levels of encryption certification, provide preventive and compensatory controls for financial services regulatory workloads, multi-architecture support and proactive, and automated security. For more information on how to enable your account, see [Enabling your account to use Finantial Services Validated products](https://cloud.ibm.com/docs/account?topic=account-enabling-fs-validated).

The IBM Cloud for Financial Services Validated designation is available for services that are operating in the Dallas (us-south), Washington DC (us-east), Frankfurt (eu-de), and London (eu-gb)

multizone regions.

Use Activity Tracker Event Routing to manage auditing events in your account whe requiring Financial Services Validated status.





 PCI, SOC2, Privacy Shield and HIPAA compliance 

Activity Tracker offers ready to run event search offerings that you can use to expedite your time to greater insights. You can choose to retain your events for 7, 14, or 30 days. In addition, a 30 day HIPAA compliant offering is also available. For more information about these offerings, see [Service plans](https://cloud.ibm.com/docs/atracker?topic=atracker-service_plan).

Use Activity Tracker hosted event search offerings to manage events using a UI or to manage auditing events that are not routed by Activity Tracker Event Routing.
If unspecified, Hyper Protect Crypto Services will search for the key in every key ring that is associated with the specified instance. Therefore, it is suggested to specify the key ring ID for a more optimized request.<br><br>Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 
 correlation_ID The unique identifier that is used to track and correlate transactions. 
 encrypted_data_key Required. The ciphertext value that was returned by the original wrap operation. 



The newly wrapped data encryption key, original key version (keyVersion) that is associated with the supplied ciphertext and latest key version (rewrappedKeyVersion) associated with the new ciphertext is returned in the response entity-body. The following JSON object shows an example returned value.

{
"ciphertext": "eyJjaX ... h0Ijoi ... c1ZCJ9",
"keyVersion": {
"id": "02fd6835-6001-4482-a892-13bd2085f75d"
},
"rewrappedKeyVersion": {
"id": "12e8c9c2-a162-472d-b7d6-8b9a86b815a6"
}
}

Store and use the new ciphertext value for future envelope encryption operations so that your data is protected by the latest root key.
It groups several backup repositories (called extents) to create a pool of storage devices and systems, summarizing their capacity. This design uses scale-out backup repository functions in the backup infrastructure and one scale-out backup repository is created for a customer by default. It is recommended that no more than 300 TB is used in the scale-out backup repository with the all-in-one MS SQL Express database.

The customer backup data that is stored in the scale-out repository is encrypted with Veeam's own encryption and the encryption keys are password protected.

For long-term storage needs, the scale-out repository helps to offload data from the performance tier (local DAS on the IBM Cloud bare metal servers), to a capacity tier by using buckets in IBM Cloud Object Storage. The offload traffic is encrypted and it flows over the internal IBM Cloud private network. Each IBM Cloud Object Storage bucket is encrypted with customer-specific keys and passwords based on customer's preference. Ordering IBM Cloud Object Storage, or configuring IBM Cloud Object Storage with Veeam is not part of the automation.

For more information about ordering and configuration, see the IBM Cloud documentation and the Veeam documentation.





 Related links 



* [Veeam Backup & Replication](https://www.veeam.com/vm-backup-recovery-replication-software.html?ad=menu-products)
* [Veeam Help Center technical documentation](https://www.veeam.com/documentation-guides-datasheets.html?ad=menu-resources)
name="simple-liberty-backend-app"
type="war">

<application-bnd>
<security-role name="myrole">
<special-subject type="ALL_AUTHENTICATED_USERS"/>
</security-role>
</application-bnd>
</application>







 Step 3: Configure your web.xml fileweb.xml file 

In your web.xml file, define the areas of your application that you want to secure.



1. Define a security role. This role must be the same role that you defined in the server.xml file.

<security-role>
<role-name>myrole</role-name>
</security-role>
2. Define a security constraint.

<security-constraint>
<display-name>Security Constraints</display-name>
<web-resource-collection>
<web-resource-name>ProtectedArea</web-resource-name>
<url-pattern>/api/</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>myrole</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>







 Step 4: Test your configuration 

Now that you finished the initial installation, build the app and test your configuration to ensure that everything is working as expected.



1. Change into your application directory.
2. Build your application.

server run
3. Make a request to the protected endpoint. An error is returned.
4. [Obtain an access token](https://cloud.ibm.com/docs/appid?topic=appid-obtain-tokens).
5. With the access token that you obtained in the previous step, make a request to the endpoint. You are now be able to access the protected endpoint.
ISO 27001 requires that clocks of all relevant information processing systems within an organization or security domain must be synchronized with a single reference time source. DNS Services synchronizes the systems with Network Time Protocol (NTP) servers to ensure that all time-based activities occur synchronously everywhere on the network.

IBM DNS Services uses the following internal NTP servers:



* time.adn.networklayer.com
* systemd-timesyncd.service







 Resolving DNS names with DNS Services 

Zoom

![Diagram of DNS services overview](https://cloud.ibm.com/docs-content/v1/content/d56dbd8ab7d14086029681ee71679e14aea53723/dns-svcs/images/dns-svcs-overview.png)

Figure 1. A diagram of DNS Services workflow

As an example, consider that a DNS zone example.com is created in your DNS instance, and a resource record for www has been defined as shown in Figure 1. Also consider that a VPC 1 has been added to the DNS zone as a permitted network.

When the DNS Services server receives a name resolution request for www.example.com from a client in VPC 1, the DNS Services resolver determines that the request originated from a VPC that is a permitted network for the example.com DNS zone, and resolves the name www.example.com to the IP 10.0.0.1.

If the name resolution request for www.example.com originated from a client in VPC 2 that is not added as a permitted network to example.com, the request is forwarded to a public DNS server, and the response from public DNS server is returned to the VPC client. The scenario is referred to as a Split Horizon, where the same hostname, which is defined in both a private DNS zone and a public DNS zone, can be resolved to different IPs depending on where the DNS name resolution request originated.

DNS Services ensures a level of privacy for information that is specified in your zones and resource records.

DNS Services is private only.
[Managing access for apps in compute resources](https://cloud.ibm.com/docs/account?topic=account-trustedprofile-compute-tutorial)Managing access for apps in compute resources

This tutorial guides you through the steps to centrally manage fine-grained authorization for all applications that are running in a compute resource without creating service IDs or managing the API key lifecycle for applications. By completing this tutorial, you learn how to create a trusted profile, establish trust with compute resources based on specific attributes, and define a policy to assign access to resources.

Kubernetes service Managing your account, resources, and access



* 15 minutes
* 2022-11-15



[Managing access for federated users by using trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trustedprofile-fedusers-tutorial)Managing access for federated users by using trusted profiles

This tutorial guides you through the steps to automatically grant federated users access to your account based on external identity provider specifications. By completing this tutorial, you learn how to create a trusted profile, establish trust with federated users based on attributes that are defined in your corporate user directory, and define a policy to assign access to resources.

Kubernetes service Managing your account, resources, and access



* 20 minutes
* 2022-05-27



[Team based privacy using IAM, VPC, Transit Gateway and DNS](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-tg-dns-iam)Team based privacy using IAM, VPC, Transit Gateway and DNS

Microservices are popular because they allow an enterprise to organize their development teams around the services they deliver. This tutorial walks you through the steps of creating infrastructure for a IBM Cloud® Virtual Private Cloud (VPC) based microservice architecture. In this architecture, VPCs are connected to each other using the IBM Cloud® Transit Gateway. A set of shared microservices is accessed through host names registered in the IBM Cloud® DNS Services. Each VPC is managed by a separate team isolated by IBM Cloud® Identity and Access Management.
For example, try to ping the pod that is protected by the network policy from a pod or an IP address that is not permitted.
5. Check for log entries that are written to the /var/log/syslog path. The DST (destination) or SRC (source) IP addresses in the log entry might be different than expected due to proxies, Network Address Translation (NAT), and other networking processes. The log entry looks similar to the following.

Sep 5 14:34:40 <worker_hostname> kernel: [158271.044316] calico-packet: IN=eth1 OUT= MAC=08:00:27:d5:4e:57:0a:00:27:00:00:00:08:00 SRC=192.XXX.XX.X DST=192.XXX.XX.XX LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52866 DF PROTO=TCP SPT=42962 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0
6. Optional: Forward the logs from /var/log/syslog to [IBM® Log Analysis](https://cloud.ibm.com/docs/openshift?topic=openshift-healthopenshift_logging).