vania-janet/multiturn-rag-retrieval-data huggingface dataset:
PE-17 - Alternate Work Site 



  Control requirements 

The organization:

PE-17 (a)
:   Employs [Assignment: organization-defined security controls] at alternate work sites;

PE-17 (b)
:   Assesses as feasible, the effectiveness of security controls at alternate work sites; and

PE-17 (c)
:   Provides a means for employees to communicate with information security personnel in case of security incidents or problems.





  NIST supplemental guidance 

Alternate work sites may include, for example, government facilities or private residences of employees. While commonly distinct from alternative processing sites, alternate work sites may provide readily available alternate locations as part of contingency operations. Organizations may define different sets of security controls for specific alternate work sites or types of sites depending on the work-related activities conducted at those sites. This control supports the contingency planning activities of organizations and the federal telework initiative.
Refreshing the queue manager TLS security 

If you make a change to the queue manager key store or trust store, or change channel certificate configuration, a TLS security refresh is required for the new configuration to take effect.

A TLS security refresh will update the in memory copy of the key store and trust store. All channels that are enabled for TLS will be stopped and use the refreshed configuration to recreate a secure connection. A client's secure connection will only be re-established if the client application has retry logic to re-initiate a broken connection.



 When to refresh TLS security 



* If you add a client or queue manager certificate to the trust store, they will not be trusted to make a secure connection until a TLS security refresh has been performed
* If you add a certificate to the key store and configure it for use with TLS or AMS, the affected channels will not use the certificate to create a secure connection until a TLS security refresh has been performed
* If you change the certificate configured on a TLS enabled channel, the certificate will not be used to create a secure connection until a TLS security refresh has been performed







 How to refresh TLS security 



 Using the web console 



1. Launch the queue manager web console using steps described [here](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_admin_mqwebconnect_mqoc_admin_mqweb)
2. On the queue manager page, select Configuration. ![Image showing entering cipher spec](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_webconsole_qm_configuration.png)
3. Select the Security tab. !
In this file, you add the configuration to create a security group service instance. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).

The security group resource in the following example is named sg1. For more information, see the [ibm_security_group](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/security_group) usage example.

resource "ibm_security_group" "sg1" {
name = "sg1"
description = "allow my app traffic"
}
3. Initialize the Terraform CLI.

terraform init
4. Create a Terraform execution plan. The Terraform execution plan summarizes all the actions that need to be run to create the security group instance in your account.

terraform plan
5. Create the security group instance in IBM Cloud.

terraform apply
6. From the [IBM Cloud resource list](https://cloud.ibm.com/resources), select the security group instance that you created and note the instance ID.
CSPM APIs 

The IBM Cloud® Security and Compliance Center Workload Protection CSPM API can be used to generate remediation reports and create tasks.

Consider the following when using the CSPM API:



*  You must specify a zone in the request. If a zone is not specified, the results will be returned for policies applied to the default "Entire infrastructure" zone.
*  Empty results are returned if no policy is applied to the "Entire infrastructure" zone.
*  URL links to each control resource list API call are contained in the compliance results response.



For more information on the CSPM API, see the [IBM Cloud Security and Compliance Center Workload Protection API documentation.](https://cloud.ibm.com/apidocs/workload-protectioncompliance-views)
* Fetch the Data Security Broker Manager URL from the Locations column for the dsb-nginx service.







 To configure Data Security Broker Manager, perform the following steps 



1. Copy the load_balancer_url from the Kubernetes dashboard for the IKS cluster or from the Openshift web console for the ROKS cluster.
2. Open a browser window and paste the load_balancer_url in the following format:

https://<load balancer url without the port number>

Example: If the LoadBalancer IP is [http://150.238.243.117:443/](http://150.238.243.117:443/), specify the IP in the format [https://150.238.243.117](https://150.238.243.117)

The warning Your connection is not private is displayed.
3. Click Advanced, and click the Proceed to link at the bottom of the page.
4. The Getting Started dialog to proceed with the configuration of the Data Security Broker Manager appears as shown below:

Zoom

![Getting Started](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/getting_started.svg)

Getting Started
5. Configure the basic System Settings by entering the hostname, domain name, proxy access, and click Continue.



* The domain name is part of the email, followed after the "@" character. For example, if the email specified is test@example.com, the domain name must be specified as example.com.
* The proxy access name is the name that is responsible for the connectivity from Proxy to Data Security Broker Manager (the IP, or DNS, or the Service Name). For example, dsb-nginx.



6. Create an Admin Account for the initial Data Security Broker Manager administrator by specifying the email address in the Configure Super Admin User page.
HTTP requests are on port 80 and 443.
6. Click Create security group to create it.
7. Navigate to Security Groups, then select vpc-secure-bastion-sg.
8. Finally, edit the security group and add the following outbound rule.



Bastion: Outbound rules

 Protocol Destination type Destination Port / Value 

 TCP Security group vpc-secure-maintenance-sg Ports 22-22 









 Step 3: Use the bastion host to access other instances in the VPC 

In this section, you will create a subnet with virtual server instance and a security group.

If you already have virtual server instances in your VPC that you want to connect to, you can skip the next three sections and start at [Add virtual server instance(s) to the maintenance security group](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-secure-management-bastion-servervpc-secure-management-bastion-server-add-vsi-to-maintenance).



 Create a subnet 

To create a new subnet,



1. Click Subnets under Network on the left pane, then click Create.



* Enter vpc-secure-private-subnet as name, then select the VPC you created.
* Select a resource group same as your VPC.
* Select a Location and zone.
* Enter the IP range for the subnet in CIDR notation, i.e., 10.xxx.1.0/24. Leave the Address prefix as it is and select the Number of addresses as 256.



2. Switch the Public gateway to Attached.
3. Click Create subnet to provision it.







 Create a security group 

To create a new security group:



1. Click Security groups under Network, then click Create.
2. Enter vpc-secure-private-sg as name and select the VPC you created earlier.
3. Click Create security group.







 Create a virtual server instance 

To create a virtual server instance in the newly created subnet:



1.
Security Assessment and Authorization (CA) [CA-3 Information Exchange](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ca-3) 
 System and Communications Protection (SC) [SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7 (4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-10 Network Disconnect](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-10) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 Next steps
The access_ control_mode property value is security_group, which means that access to the share is determined by the rules of a security group.

{
"access_control_mode": "security_group",
"created_at": "2023-07-05T22:58:49.000Z",
"crn": "crn:[...]",
"encryption": "provider_managed",
"href": "https://us-south.iaas.cloud.ibm.com/v1/shares/199d78ec-b971-4a5c-a904-8f37ae710c63",
"id": "199d78ec-b971-4a5c-a904-8f37ae710c63",
"iops": 14400,
"lifecycle_state": "stable",
"mount_targets": [
{
"href": "https://us-south.iaas.cloud.ibm.com/v1/shares/199d78ec-b971-4a5c-a904-8f37ae710c63/mount_targets/d5fd8173-f519-4ff7-8f63-0ead23ecf1f4",
"id": "d5fd8173-f519-4ff7-8f63-0ead23ecf1f4",
"name": "my-share-mount-target",
"resource_type": "share_mount_target",
"vpc": {
"crn": "crn:...]",
"href": "https://us-south.iaas.cloud.ibm.com/v1/vpcs/c2d941de-27f5-432c-b4d0-37a8491c3216",
Other resources for IBM security groups 

These resources are created by IBM and some of our partners and customers for IBM Cloud® security groups.



*  [Blog Post: Illustrating Uses of IBM Cloud Security Groups](https://www.ibm.com/cloud/blog/illustrating-uses-ibm-cloud-security-groups)

Security groups firewall your IBM Cloud applications from nefarious network traffic, protecting you and your company from the efforts of 'industrious users' trying to bring down your application, or make off with your customer’s credit card details. If those sound like sub-optimal outcomes for your situation, read on…
*  [Blog Post: Regulate access to your network resources with IBM Cloud security groups](https://www.ibm.com/cloud/blog/network-security-groups)

IBM Cloud security groups are a set of IP filter rules (five-tuple rules: source and destination IP, source and destination port, and protocol) that define how to handle incoming (ingress) and outgoing (egress) traffic to both the public and private interfaces of a virtual server instance. The rules added to the security group are known as security group rules.
*  [Blog Post: Take control of your cloud network with security groups](https://www.ibm.com/cloud/blog/security-groups)

In a cloud environment, you must consider 'who talks to whom.' One way to regulate this conversation is through security groups.
To use security groups, first you must have a running IBM Cloud VPC.

For instructions about creating a VPC and subnet, see [Creating a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-rest-apis).



 Step 1: Create a security group 

Create a security group named my-security-group in your IBM Cloud VPC.

curl -X POST "$vpc_api_endpoint/v1/security_groups?version=$api_version&generation=2" -H "Authorization: $iam_token" -d '{
"name": "my-security-group",
"vpc": { "id": "'$vpc'" }
}'

Save the ID in a variable so you can use it later; for example, the variable sg:

sg=0738-2d364f0a-a870-42c3-a554-000000632953





 Step 2: Add a rule to allow SSH connections 

Create a rule on the security group to allow inbound connections on port 22.

curl -X POST "$vpc_api_endpoint/v1/security_groups/$sg/rules?version=$api_version&generation=2" -H "Authorization: $iam_token" -d '{
"direction": "inbound",
"protocol": "tcp",
"port_min": 22,
"port_max": 22
}'





 Step 3: Delete the security group (optional) 

To clean up the security group, it cannot be associated with any network interfaces, and it cannot be referenced by a rule in a different security group.

curl -X DELETE "$vpc_api_endpoint/v1/security_groups/$sg?version=$api_version&generation=2" -H "Authorization: $iam_token"
Getting started with FortiGate Security Appliance 10 Gbps 

The FortiGate Security Appliance (FSA) 10 Gbps is a hardware firewall that can be configured to protect traffic on multiple VLANs for both public and private networks.



  Ordering the FSA 10 Gbps 

To order a FortiGate Security Appliance 10 Gbps, follow these steps:



1.  From your browser, open the FSA page in the [IBM Cloud console](https://cloud.ibm.com/classic/security/firewalls/multivlan/provision) and log in to your account.
2.  Give the firewall a name.
3.  Select your data center and pod from the menus. Availability is limited to select locations.
4.  Choose to have a single FSA, or enable failover protection with the High Availability option.
5.  Choose from the list of Add-ons or bundle all of them together for a discounted price. The Order Summary box displays the updated information for your current order.
6.  Review your selections, check that you read the Third-Party Service Agreements, then click Create. The order is verified automatically.



When the provisioning process is complete, the new FSA shows in the [Firewalls list page](https://cloud.ibm.com/docs/fortigate-10g?topic=fortigate-10g-viewing-a-list-of-firewalls). Click the FSA name to open the Firewall Details page. The IP addresses, login username, and password for the device are shown.
For more information on setting up security group rules using the API, see [Setting up the security group for your virtual server instance by using the API](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-the-security-group&interface=apisg-using-api).





 Getting started 

To get started using security groups, follow these steps:



1. Decide if you want to create a new security group for your resource, and [Create your security group](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-the-security-group&interface=ui).
2. Review the public gateway that you've created in the [IBM Cloud console](https://cloud.ibm.com/login).







 Security group use cases 

Creating a security group is a standard way for a user to apply rules that filter network traffic patterns to and from their resources. Your ability to perform the following actions depends on your level of authorization in your account. Contact your administrator if you have questions about your account authorizations.



 Use Case 1: Changing a resource's default security group 

Every VPC has a default security group, which is a security group that is created for a user. That default security group also has a default policy. This default policy is the same default policy that is assigned to security groups you create before you customize the policy's setting by adding or removing rules.

A default security group is different from the default policy for new security groups. You can customize both the policy on your default security group, as well as the default policy assigned to new security groups.

For example, let's say you are part of an organization and someone with access to your organization's account modifies the default security group's policy to be different than the default policy you get when you create a new security group. Your team member is a very security-conscious customer, and they change the default security group settings to deny all inbound and outbound network traffic.

In this example, if you create a new resource, it will initially be assigned to your VPC's default security group.
PM-6 - Information Security Measures of Performance 



  Control requirements 

PM-6 - 0
:   The organization develops, monitors, and reports on the results of information security measures of performance.
Complete the following steps to install the Data Security Broker Manager from the IBM Cloud catalog:



1. Click Data Security Broker Manager catalog item.
2. The Data Security Broker Manager catalog item opens in a seperate window. In the Select your deployment target drop down, select IBM Cloud® Kubernetes Service (IKS) or Red Hat Openshift (ROKS) to install the Data Security Broker Manager in the IKS or ROKS cluster.

Zoom

![Data Security Broker Manager](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/dep_target.svg)

Data Security Broker Manager
3. The delivery method is selected as HELM chart by default under the Select a delivery method drop down.
4. Select the version of the software to install, in the Select Version drop-down.
5. From the list of available clusters, select the cluster on which you wish to perform the installation.

Zoom

![List of clusters](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/clusters.svg)

List of clusters
6. Select an existing namespace to deploy the Data Security Broker Manager or click Add namespace to add a new namespace. Specify the name for the namespace and click Add to create a new namespace within the selected cluster.
7. If you are installing the Data Security Broker Manager in the ROKS cluster, you must run the preinstallation script by clicking on the Run Script button after you select the cluster and the project.

Once the preinstallation script is executed, you can get the Data Security Broker Manager URL from the preinstallation script logs.
8. Configure your workspace by specifying the following details:

a. Specify the Name for the workspace.
Logging and Debugging 

Overview:

This section demonstrates how to enable logging for Data Security Broker. Use IBM® Log Analysis to add log management capabilities to Data Security Broker.

The logging agent collects and forwards logs to your IBM Log Analysis instance. After you provision an IBM® Log Analysis instance, you must configure a logging agent for each log source that you want to monitor in Data Security Broker Manager. For more information on provisioning a log instance, see [Logging with IBM Cloud Services](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-getting-started).



 Pre-requisites 



* You need a logdna instance, which is configured to receive platform logs.







 Procedure 

To configure a logging instance from the Observability dashboard in the IBM Cloud, complete the following steps:



1. Log in to your IBM Cloud account. After you log in, the IBM Cloud UI opens.
2. Go to the Menu icon in the left navigation and click Observability to access the Observability dashboard.
3. Click Logging, then click Options > Edit Platform.
4. Select a region.
5. Choose which logging instance will receive logs from Data Security Broker on that location.
6. Click Select to create the log instance.

After you provision an instance of the IBM Log Analysis service in the IBM Cloud, and configure a logging agent for a log source, you can view, monitor, manage log data, and debug the logs through the IBM Log Analysis Web UI. To debug the logs, follow the steps below:

a. Log in to your IBM Cloud account. After you log in, the IBM Cloud UI opens.

b. Go to the Menu icon in the left navigation and click Observability to access the Observability dashboard.

c. Click Logging and select the log instance which you have created for the Data Security Broker.

d. Click Open Dashboard for the log instance that you have created. You can view the detailed log summary in the dashboard as shown below:

Zoom

!
Getting started with Security and Compliance Center 

For highly regulated industries, such as financial services, achieving continuous compliance within a cloud environment is an important first step toward protecting customer and application data. Historically, that process was difficult and manual, which placed your organization at risk. But, with IBM Cloud® Security and Compliance Center, you can integrate daily, automatic compliance checks into your development lifecycle to help minimize that risk.



 Before you begin 

Before you get started, be sure that you have resources in your account to evaluate. You must also have a bucket in the Cloud Object Storage service that can be used to store your results data.

Running an evaluation does not ensure regulatory compliance. An evaluation provides a point in time statement of your current posture for a specific resource. It is your responsibility to review and interpret the results to ensure that your organization is adhering to the controls that are required for your industry.





 Step 1: Create an instance 

To get started with Security and Compliance Center, you must first create an instance of the service.



1. Go to the [IBM Cloud catalog](https://cloud.ibm.com/catalog) and search for [Security and Compliance Center](https://cloud.ibm.com/catalog/services/security-and-compliance-center).
2. In the service details page, select a location. The selected location is where Security and Compliance Center will conduct the evaluation of your resources.
3. Select a pricing plan. Options include Standard or Trial.
4. Configure your resource by providing a name for the instance, specifying a resource group and adding any needed tags.
5. Acknowledge and agree to the terms and conditions.
6. Click Create.







 Step 2: Assign access 

If you are working in a larger organization, you might need to start by assigning access to those on your team who will be managing compliance.



1. [Create an access group](https://cloud.ibm.com/docs/account?topic=account-groupscreate_ag) and add your compliance focals.
2.
Editing a security group 

After you've created your IBM Cloud® security groups object, you can modify its parameters and rules.



  Editing security group details 



1.  From the [IBM Cloud console](https://cloud.ibm.com/), click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure to get to the Classic Infrastructure landing page.
2.  From the Classic Infrastructure menu, select Security > Network Security > Security Groups to get to the Security Groups page.
3.  On the Security Group page, click the ![More icon](https://cloud.ibm.com/docs-content/v1/content/f3a430977b1e79176682f947de41fc02945c41e7/security-groups/images/more_icon.jpg) icon of the security group object that you want to assign instances to, then select Edit Details.
4.  Modify the name or description as required, then click Edit group to apply the changes.







  Editing security group rules 



1.  From the [IBM Cloud console](https://cloud.ibm.com/), click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure to get to the Classic Infrastructure landing page.
2.  From the Classic Infrastructure menu, select Security > Network Security > Security Groups to get to the Security Groups page.
3.  On the Security Group page, select the security group object that you want to modify.
4.  Click the ![More icon](https://cloud.ibm.com/docs-content/v1/content/f3a430977b1e79176682f947de41fc02945c41e7/security-groups/images/more_icon.jpg) icon to edit the existing rules.
5.  Modify the rule as necessary.
6.  Click OK to apply the changes.