vania-janet/multiturn-rag-retrieval-data huggingface dataset:
CA-2 - Security Assessments 



 Control requirements 

The organization:

CA-2 (a)
: Develops a security assessment plan that describes the scope of the assessment including:



1. Security controls and control enhancements under assessment;
2. Assessment procedures to be used to determine security control effectiveness; and
3. Assessment environment, assessment team, and assessment roles and responsibilities;



CA-2 (b)
: Assesses the security controls in the information system and its environment of operation [IBM Assignment: at least annually] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

CA-2 (c)
: Produces a security assessment report that documents the results of the assessment; and

CA-2 (d)
: Provides the results of the security control assessment to [IBM Assignment: individuals or roles to include the customer management].





 Additional IBM Cloud for Financial Services specifications 



* The customer has the right to request and review organization processes, procedures, and documentation (e.g. architecture diagrams, security and control environment, data management, incident management, etc.) in order to validate customer's policy, standards, outsourcing risk management framework, and regulatory requirements are being met by the organization.







 NIST supplemental guidance 

Organizations assess security controls in organizational information systems and the environments in which those systems operate as part of: (i) initial and ongoing security authorizations; (ii) FISMA annual assessments; (iii) continuous monitoring; and (iv) system development life cycle activities. Security assessments: (i) ensure that information security is built into organizational information systems; (ii) identify weaknesses and deficiencies early in the development process; (iii) provide essential information needed to make risk-based decisions as part of security authorization processes; and (iv) ensure compliance to vulnerability mitigation procedures. Assessments are conducted on the implemented security controls from Appendix F (main catalog) and Appendix G (Program Management controls) as documented in System Security Plans and Information Security Program Plans. Organizations can use other types of assessment activities such as vulnerability scanning and system monitoring to maintain the security posture of information systems during the entire life cycle.
MP-3 - Media Marking 



  Control requirements 

The organization:

MP-3 (a)
:   Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and

MP-3 (b)
:   Exempts [IBM Assignment: no removable media types] from marking as long as the media remain within [Assignment: organization-defined controlled areas].





  NIST supplemental guidance 

The term security marking refers to the application/use of human-readable security attributes. The term security labeling refers to the application/use of security attributes with regard to internal data structures within information systems (see AC-16). Information system media includes both digital and non-digital media. Digital media includes, for example, diskettes, magnetic tapes, external/removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes, for example, paper and microfilm. Security marking is generally not required for media containing information determined by organizations to be in the public domain or to be publicly releasable. However, some organizations may require markings for public information indicating that the information is publicly releasable. Marking of information system media reflects applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
security-group is.security-group.security-group.create Security Group was created 
 security-group is.security-group.security-group.delete Security Group was deleted 
 security-group is.security-group.security-group.update Security Group was updated 
 security-group is.security-group.security-group.read One or more security groups were retrieved 
 security-group is.security-group.security-group-rule.create Rule was added to Security Group 
 security-group is.security-group.security-group-rule.delete Rule was removed from Security Group 
 security-group is.security-group.security-group-rule.update Security Group Rule was updated 
 security-group is.security-group.security-group-rule.read One or more security group rules was retrieved 
 security-group is.security-group.security-group-interface.attach Interface was attached to Security Group 
 security-group is.security-group.security-group-interface.detach Interface was removed from Security Group 
 security-group is.security-group.security-group-interface.read One or more security group interfaces was retrieved 







 Subnet events 



Table 8. Actions that generate events for Subnet

 Resource Action Description 

 subnet is.subnet.subnet.create Subnet was created 
 subnet is.subnet.subnet.update Subnet was updated 
 subnet is.subnet.subnet.delete Subnet was deleted 
 subnet is.subnet.subnet.read One or more subnets was retrieved 
 subnet is.subnet.network-acl.update Subnet's Network ACL was replaced 
 subnet is.subnet.public-gateway.attach Public Gateway was attached to Subnet 
 subnet is.subnet.public-gateway.detach Public Gateway was detached from Subnet 
 subnet is.subnet.public-gateway.read A subnet public-gateway attachment was retrieved 







 Virtual private endpoints events 

The following table lists the actions that are related to virtual private endpoints and the generation of events.



Table 9. Actions that generate events for virtual private endpoints

 Resource Action Description
* UI
* CLI
* API







 Setting up a security group for your resource 

You can configure security groups to define the inbound and outbound traffic that is allowed for your resource. For example, after you configure ACL rules for the subnet based on your company's security policies, you can further restrict traffic for specific instances depending on their workloads.



 Setting up the security groups for your resource in the UI 

To configure your security group by using the UI, follow these steps:



1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login).
2. Select the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg), then click VPC Infrastructure.
3. Click Security groups.
4. Click Create + on the security groups list table.
5. In the Location section, provide the following information:



* Geography - Indicate the general area where you want the security group created.
* Region - Indicate the region where you want the security group created.



6. In the Details section, provide the following information:



* Name - Enter a unique identifier for the security group, such as my-security-group.
* Resource group: Select a resource group for the security group.



After provisioning is complete, you cannot change the resoure group.



* Tags - Add user tags. User tags are visible account-wide. For more information, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).



User tags are visible account-wide. Avoid including sensitive data in the tag name.



* Optional:Access management tags - Add access management tags to help organize access control relationships.
PM-1 - Information Security Program Plan 



  Control requirements 

The organization:

PM-1 (a)
:   Develops and disseminates an organization-wide information security program plan that:



1.  Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2.  Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3.  Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
4.  Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;



PM-1 (b)
:   Reviews the organization-wide information security program plan [IBM Assignment: at least annually];

PM-1 (c)
:   Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and

PM-1 (d)
:   Protects the information security program plan from unauthorized disclosure and modification.
Understanding High Availability for IBM Cloud Data Security Broker 

Data Security Broker components can be deployed in an environment with highly available configuration to minimize or eliminate the downtime caused by momentary failures of Data Security Broker components or the infrastructure they depend on, ensuring the continuous availability of data protected by Data Security Broker Data Protection services. The high volume of data access during peak load periods that can result from deployment in a highly available configuration can also help mitigate service degradations.



 Overview of High Availability Architecture 

A management server connects to the proxies and manages their configuration and settings, and proxies are placed in the data paths between applications and data stores as part of the Data Security Broker Data Protection service. Figure 1 shows the control path, which is made up of the management servers and the connections between the proxies and the management servers.

Zoom

![Control path vs data path](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/ha_ctr_data_path.svg)

Figure 1: Control path vs data path

The data path's proxies can function without maintaining a constant connection to the management server. Furthermore, deployments rarely involve changing configuration and policy settings. With a much stricter availability requirement for the proxies than the management server, this means that the availability requirement for data path components and control path components can differ.

Data Security Broker typically advises using Data Security Broker Shields to achieve consistent availability with the database it is protecting. Shields must typically be installed in as many regions and availability zones as the database. To take advantage of the dynamic routing and scaling features provided by the framework, Data Security Broker also advises customers to deploy Data Security Broker components in a Kubernetes or Red Hat OpenShift environment.

Data Security Broker suggests maintaining a standby Data Security Broker Manager instance with regular metadata synchronization for organizations that needs to shorten the time it takes to restore access to a Data Security Broker Manager instance.





 Deploying Data Security Broker Shields for High Availability 

Data Security Broker recommends deploying in Kubernetes or OpenShift clusters for use cases that demand high availability.
AC-16 - Security Attributes 



 Control requirements 

The organization:

AC-16 (a)
: Provides the means to associate [Assignment: organization-defined types of security attributes] having [Assignment: organization-defined security attribute values] with information in storage, in process, and/or in transmission;

AC-16 (b)
: Ensures that the security attribute associations are made and retained with the information;

AC-16 (c)
: Establishes the permitted [Assignment: organization-defined security attributes] for [Assignment: organization-defined information systems]; and

AC-16 (d)
: Determines the permitted [Assignment: organization-defined values or ranges] for each of the established security attributes.





 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Tagging IBM Cloud resources and managing access with tags](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-tagging-resources)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for AC-16 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 AC-16 (a) <br><br> * IBM Cloud provides the means to associate a customer-defined security identifier and attributes with IBM Cloud resources (for example, tags)<br><br><br> 







 NIST supplemental guidance 

Information is represented internally within information systems using abstractions known as data structures. Internal data structures can represent different types of entities, both active and passive. Active entities, also known as subjects, are typically associated with individuals, devices, or processes acting on behalf of individuals. Passive entities, also known as objects, are typically associated with data structures such as records, buffers, tables, files, inter-process pipes, and communications ports.
Configure security groups 

This section of the documentation describes the configuration of the security groups to allow the required traffic flow. Three security groups have been used in this deployment pattern:



* Bastion - This security groups protects the bastion hosts.
* AD - This security groups protects the AD servers.
* SQL - This security groups protects the SQL servers.



If you are deploying the Dual MZR pattern then you will have two sets of three security groups as security groups are restricted to a VPC

The traffic flows are as follows, as security groups are stateful, only the initiation of the traffic flow is required to be allowed:



* RDP traffic from the Internet to the bastion hosts sourced from administrator's laptops.
* RDP traffic from the bastion hosts to the virtual servers.
* HTTPS traffic from the bastion hosts to Internet resources for downloading.
* SMB traffic between the Windows servers.
* RPC traffic between the Windows cluster nodes.
* Replication traffic between domain controllers.
* AD traffic between member servers and domain controllers
* SQL traffic on TCP 1433 from the bastion hosts to the SQL servers.
* SQL client to listener on TCP 6789 from the bastion hosts to the SQL servers.
* Always On availability group traffic on TCP 5022 between Microsoft SQL servers.
* ICMP traffic between internal resources.
* DNS traffic on UDP 53 to the AD servers.
* IBM Cloud endpoints traffic:



* DNS resolver traffic on UDP 53 to the IBM DNS resolvers 161.26.0.10 and 161.26.0.11.
* DNS traffic on UDP 53 to the AD servers.
* NTP traffic on UDP 123 to the IBM NTP server at 161.26.0.6.







 RDP traffic from the Internet 

<IP_Address> is the external IP address of the connection from the administrator. If there is more than one IP the consider the use of the CIDR Source Type.



* Security Group: Bastion
* Rule: Inbound
* Protocol: TCP
* Source Type: IP Address
* Source: <IP_Address>
* Value: Ports 3389







 RDP traffic from the bastion hosts
The security groups applied to the workers in the cluster are a combination of the security groups applied when you create the cluster and [when you create the worker pool](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-groupvpc-sg-worker-pool). A total of five security groups can be applied to workers, including the default security groups and any security groups applied to the worker pool. Note that these security group options are only available in the CLI.

The security groups applied to a cluster cannot be changed once the cluster is created. You can [change the rules of the security groups](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-groupvpc-sg-create-rules) that are applied to the cluster, but you cannot add or remove security groups at the cluster level. If you apply the incorrect security groups at cluster create time, you must delete the cluster and create a new one.



 If you only want the default VPC and cluster security groups and no additional security groups 

VPC security group

Cluster security group

Note that this is the default behavior at cluster create time.

When you create your cluster, do not specify any additional security groups.

Example command to create a VPC cluster with only the default VPC and kube-<cluster-id> cluster security groups:

ibmcloud oc cluster create vpc-gen2 --name <cluster-name> --zone <zone> --vpc-id <vpc-id> --subnet-id <subnet-id>

The following security groups are applied:



* Default VPC security group (randomly generated name)
* kube-<cluster-id>







 If you only want the cluster security group and not the default VPC security group 

Cluster security group

When you create the cluster specify --cluster-security-group cluster. Do not specify any additional security groups.

Example command to create a VPC cluster with only the kube-<cluster-id> cluster security group:
Creating a security group 

You can create and configure a custom IBM™ Cloud Security Group using the instructions here.



1.  From your browser, open the [IBM Cloud console](https://cloud.ibm.com/) and log into your account.
2.  From the Dashboard, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure to get to the Classic Infrastructure landing page.
3.  From the Classic Infrastructure menu, select Security > Network Security > Security Groups to get to the Security Groups page.
4.  On the Security Groups page, click on the Create Group + button.
5.  Enter a name for the Security Group and optionally a description.
6.  Click Create Group.

Zoom

![Create a Security Group](https://cloud.ibm.com/docs-content/v1/content/f3a430977b1e79176682f947de41fc02945c41e7/security-groups/images/create_sg.jpg)

Create a security group



Note that the Create group with a default… checkbox is unmarked. This means no outbound rule will be created for this Security Group object. As a result, unless other outbound rules or Security Group objects are created, only incoming requests (such as SSH and ICMP) and their related (outgoing) traffic flows or responses will be permitted.



  Next step... 

[Create a rule](https://cloud.ibm.com/docs/security-groups?topic=security-groups-creating-a-new-rule) to allow incoming requests (SSH & ICMP) and their related (outgoing) traffic flows.
Security and Compliance Readiness Bundle overview 

New deployments of Security and Compliance Readiness Bundle instances are no longer supported. You can still add or delete clusters, add or delete VMware ESXi™ servers or NFS storage, and add or remove services for existing instances. You can also view and delete your Security and Compliance Readiness Bundle instances.

The Security and Compliance Readiness Bundle offering is a prescriptive offering that provides many of the security and compliance features of IBM Cloud® for Financial Services™. The offering is packaged with security and compliance tools and templates for you to use with your preferred regulation standard.



  Technical specifications for Security and Compliance Readiness Bundle 

Review the following specifications:



*  The Security and Compliance Readiness Bundle offering is based on VMware® NSX-T™ and VMware vSphere® 7.0.
*  If you add services later on, some of them require configuration setup. Review each service and ensure that you configure its settings as indicated.







  Options not available for Security and Compliance Readiness Bundle 

The following options or settings are not available for Security and Compliance Readiness Bundle:



*  Local disks
*  High performance with Intel® Optane
*  Single public Windows® VSI for Active Directory™ DNS configuration. Only the option to order two highly available dedicated Windows server virtual machines (VMs) on the management cluster is available.
Configure Data Security Broker Manager 

Configuring the Data Security Broker Manager console is the first step to login and implement the data protection services.



 Prerequisites 

Before you begin configuring Data Security Broker Manager, ensure you meet the following requirements:



* Data Security Broker Manager must have been installed.
* Load Balancer URL is required to access the Data Security Broker Manager.

To obtain the Load_balancer_url of the dsb-nginx service, perform the following steps.



* Log into your IBM Cloud account.
* Select Resource List from the left navigation menu. Click Containers to view the list of clusters.
* Select the cluster where you have installed the Data Security Broker Manager instance.









 IBM Cloud® Kubernetes Service 



* If you have installed the Data Security Broker Manager in a Kubernetes cluster, click Kubernetes Dashboard to navigate to the Kubernetes Dashboard from the cluster.
* Select the namespace from the drop-down, on which you have installed the Data Security Broker Manager.
* Navigate to Services to view the list of Data Security Broker Manager services running in the namespace.
* Fetch the LoadBalancer IP from the External Endpoints column for the dsb-nginx service.







 Red Hat® OpenShift® 



* If you have installed the Data Security Broker Manager in a Red Hat OpenShift cluster, click Openshift web console from the cluster.
* Click Projects in the left navigation menu and select the project from the drop-down, on which you have installed the Data Security Broker Manager.
* Navigate to Networking -> Routes to view the list of Data Security Broker Manager services running in the project.
* Fetch the Data Security Broker Manager URL from the Locations column for the dsb-nginx service.







 To configure Data Security Broker Manager, perform the following steps 



1. Copy the load_balancer_url from the Kubernetes dashboard for the IKS cluster or from the Openshift web console for the ROKS cluster.
2. Open a browser window and paste the load_balancer_url in the following format:

https://<load balancer url without the port number>