vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you edit the rules of the default security group, those edited rules then apply to all current and future servers in the group. For more information, see [Updating default security group rules](https://cloud.ibm.com/docs/vpc?topic=vpc-updating-the-default-security-groupupdating-the-default-security-group).



 Security group targets 

A target is any resource you attach or detach a security group to or from. Security group targets include virtual server instance network interfaces, endpoint gateways, and load balancers.

Each resource that can send and receive traffic can have a security group policy configured for it. This can include virtual server interfaces, bare metal servers, load balancers, any end point gateways along your data path, and more.

You can associate a security group policy with any resource along your data path.





 Security groups versus network ACLs 

Security groups are tied to a resource, whereas Network Access Control Lists (NACLs) are tied to the subnet.

NACLs are applicable at the subnet level, so any resource in the subnet with an associated NACL will follow rules of the NACL. However, that’s not the case with security groups. Security groups must be assigned explicitly to the resource. Also, unlike NACLs, a security group can be applied to multiple resources across subnets and even across zones.

NACLs are stateless.

Because NACLs are not stateful, if you want to permit traffic both ways on a target you must set up two rules.

Zoom

![Security groups across instances and zones](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/security-groups-across-zones.svg)

Figure 1: Security groups across instances and zones





 Defining security group rules 

Every security group consists of a set of rules. The security group examines all of its rules before allowing any traffic to enter or leave the instance.
AT-4 - Security Training Records 



  Control requirements 

The organization:

AT-4 (a)
:   Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

AT-4 (b)
:   Retains individual training records for [IBM Assignment: at least one year].





  NIST supplemental guidance 

Documentation for specialized training may be maintained by individual supervisors at the option of the organization.
Security for the application workloads is a fundamental prerequisite, to complement the resilience and scalability afforded by public cloud.

This tutorial takes you through the creation of a scalable and secure Internet facing web application hosted in private network secured using a virtual router appliance (VRA), VLANs, NAT and firewalls. The application comprises a load balancer, two web application servers and a MySQL database server. It combines three tutorials to illustrate how web applications can be securely deployed on the IBM Cloud IaaS platform using classic networking.



 Objectives 



* Create Virtual Servers to install PHP and MySQL
* Provision a Load Balancer to distribute requests to the application servers
* Deploy a Virtual Router Appliance (VRA) to create a secure network
* Define VLANs and IP subnets
* Secure the network with firewall rules
* Source Network Address Translation (SNAT) for application deployment



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/4b22b8d0e113e2faeb720360eb986a54d8bf3a05/loadbalancer-service/includes/solution-tutorials/includes/solution-tutorials/images/solution42-web-app-private-network/web-app-private.png)

Figure 1. Architecture diagram of the tutorial



1. Configure Secure Private Network
2. Configure NAT access for application deployment
3. Deploy scalable web app and load balancer







 Before you begin 

This tutorial utilises three existing tutorials, which are deployed in sequence. All three should be reviewed before commencing:



* [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure)
* [Configure NAT for Internet access from a secure network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-nat-config-private)
* GROUP: ID or name of the security group.
* TARGET1: ID or name of the bound target resource for security group. If you use the name format, only the resources under the same resource type are supplied. And for network interface by name, all the network interface names must be under the same instance. The following types are supported target resource types: network_interface, load_balancer, endpoint_gateway, vpn_server.
* TARGET2: ID or name of the bound target resource for security group. If you use the name format, only the resources under the same resource type are supplied. And for network interface by name, all the network interface names must be under the same instance. The following types are supported target resource types: network_interface, load_balancer, endpoint_gateway, vpn_server.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --trt: The bound target resource type, this option is only required if you use the target name instead of ID. One of: load_balancer, endpoint_gateway, vpn_server.
* --in: The ID or name of the instance to be bound. It is only required if you use the network interface name instead of ID.
* --bm: The ID or name of the bare metal server to be bound. It is only required if the network interface name is used instead of ID.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is security-group-targets 

List all targets of a security group.

ibmcloud is security-group-targets GROUP [--vpc VPC] [--output JSON] [-q, --quiet]



 Command examples
Security for the application workloads is a fundamental prerequisite, to complement the resilience and scalability afforded by public cloud.

This tutorial takes you through the creation of a scalable and secure Internet facing web application hosted in private network secured using a virtual router appliance (VRA), VLANs, NAT and firewalls. The application comprises a load balancer, two web application servers and a MySQL database server. It combines three tutorials to illustrate how web applications can be securely deployed on the IBM Cloud IaaS platform using classic networking.



 Objectives 



* Create Virtual Servers to install PHP and MySQL
* Provision a Load Balancer to distribute requests to the application servers
* Deploy a Virtual Router Appliance (VRA) to create a secure network
* Define VLANs and IP subnets
* Secure the network with firewall rules
* Source Network Address Translation (SNAT) for application deployment



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/01ccb31b85637ed5f03008c920c9596354caaf98/virtual-router-appliance/includes/solution-tutorials/includes/solution-tutorials/images/solution42-web-app-private-network/web-app-private.png)

Figure 1. Architecture diagram of the tutorial



1. Configure Secure Private Network
2. Configure NAT access for application deployment
3. Deploy scalable web app and load balancer







 Before you begin 

This tutorial utilises three existing tutorials, which are deployed in sequence. All three should be reviewed before commencing:



* [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure)
* [Configure NAT for Internet access from a secure network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-nat-config-private)
SA-11 - Developer Security Testing and Evaluation 



 Control requirements 

The organization requires the developer of the information system, system component, or information system service to:

SA-11 (a)
: Create and implement a security assessment plan;

SA-11 (b)
: Perform [IBM Assignment: unit; integration; system; regression] testing/evaluation at [Assignment: organization-defined depth and coverage];

SA-11 (c)
: Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation;

SA-11 (d)
: Implement a verifiable flaw remediation process; and

SA-11 (e)
: Correct flaws identified during security testing/evaluation.





 Additional IBM Cloud for Financial Services specifications 



* Responsible personnel or roles must be designated and identified as approvers for each stage of testing.







 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Development processes and software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-development-processes)







 NIST supplemental guidance 

Developmental security testing/evaluation occurs at all post-design phases of the system development life cycle. Such testing/evaluation confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements. Security properties of information systems may be affected by the interconnection of system components or changes to those components. These interconnections or changes (e.g., upgrading or replacing applications and operating systems) may adversely affect previously implemented security controls. This control provides additional types of security testing/evaluation that developers can conduct to reduce or eliminate potential flaws. Testing custom software applications may require approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Developers can employ these analysis approaches in a variety of tools (e.g., web-based application scanners, static analysis tools, binary analyzers) and in source code reviews.
Working with Sysdig Secure API token 

You can use Sysdig Secure API tokens to authenticate with the IBM Cloud Security and Compliance Center Workload Protection service when you use Python scripts or the IBM Cloud Security and Compliance Center Workload Protection REST API to automate routine tasks and monitor notifications.

Consider the following information for each instance of the IBM Cloud Security and Compliance Center Workload Protection service:



* There is a Monitor API token per team.
* If the token is compromised or your organization's security policies require resetting the token after certain conditions, a user with administration permissions can reset the API token.





 Getting the Sysdig Secure API token through the Security UI 

Complete the following steps to get the Sysdig Secure API token :



1. From the Selector button in the navigation bar, choose Settings.
2. Select the User Profile option.
3. From the Sysdig Secure API section, copy the Sysdig Secure API Token.



After you get the token, you can run API calls and use this token in the Authorization header.

When you copy the token include the Bearer keyword: Authorization: Bearer MONITOR_API_TOKEN





 Resetting the Sysdig Secure API token through the Security UI 

Complete the following steps to reset the Sysdig Secure API token :



1. From the Selector button in the navigation bar, choose Settings.
2. Select the User Profile option.
3. In the Sysdig Secure API section, click Reset Token to reset the API token.







 Getting the Sysdig Secure API token by using the API 

You can use the Token API to get the Sysdig Secure API token .

For example, you can use the following cURL command to get the Sysdig Secure API token :

curl -X GET <SECURITY_REST_API_ENDPOINT>/api/token -H "Authorization: $AUTH_TOKEN" -H "IBMInstanceID: $GUID" -H "TeamID: $TEAM_ID" -H "content-type: application/json"
* When drive security is enabled, a yellow key image appears for Controller 0 AVAGO MegaRAID SAS 9361-8i.



2. Now create a secure volume by using the SEDs. Right-click Controller0 from the Logical tab and select Create Virtual Drive.
3. Choose the Advanced option. The screen needs to specify the RAID level and the Drive security method as Full Disk encryption (FDE).
4. Select the FDE Drives that are required and click Add > Create Drive Group > Next.
5. Review the virtual drive settings and make any necessary changes.



* The suggested setting for the Read Policy is Always Read Ahead.
* The suggested setting for the Write policy is Write Back.



6. Click Create Virtual Drive.
7. Accept the Write Back policy impact due to BBU by clicking Yes. Then, click Next and review the summary screen.
8. Click Finish.
9. To confirm that the virtual disk is secured, click the Logical tab and the virtual drive that was created. You see in the Drive Security Properties that the Secured field is marked Yes.







 Securing RAID volumes 

If the server came with RAID volumes that are already created by using SED drives, you can make the volume secure by completing the following step.



1. In the Logical tab, right-click Drive Group and select Secure Using FDE.

If you mixed FDE and Non-FDE drives for a volume, then this option is not visible.



You can also set up drive security by using webBIOS and logging in through the IPMI at the start time and entering the RAID BIOS.





 Removing drive security 



1. To remove drive security, you must first delete secured virtual disks and right-click on Controller 0 to Disable Drive Security. This function securely erases the data in it and removes drive security.
Security for the application workloads is a fundamental prerequisite, to complement the resilience and scalability afforded by public cloud.

This tutorial takes you through the creation of a scalable and secure Internet facing web application hosted in private network secured using a virtual router appliance (VRA), VLANs, NAT and firewalls. The application comprises a load balancer, two web application servers and a MySQL database server. It combines three tutorials to illustrate how web applications can be securely deployed on the IBM Cloud IaaS platform using classic networking.



 Objectives 



* Create Virtual Servers to install PHP and MySQL
* Provision a Load Balancer to distribute requests to the application servers
* Deploy a Virtual Router Appliance (VRA) to create a secure network
* Define VLANs and IP subnets
* Secure the network with firewall rules
* Source Network Address Translation (SNAT) for application deployment



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution42-web-app-private-network/web-app-private.png)

Figure 1. Architecture diagram of the tutorial



1. Configure Secure Private Network
2. Configure NAT access for application deployment
3. Deploy scalable web app and load balancer







 Before you begin 

This tutorial utilises three existing tutorials, which are deployed in sequence. All three should be reviewed before commencing:



* [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure)
* [Configure NAT for Internet access from a secure network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-nat-config-private)
Security Groups for Virtual Server Instances 

Create a third Security Group that is specific for each of the Virtual Server Instances, such as on the web, app, and database tiers. These Security Groups are always attached to the Virtual Server Instances and allow the HTTP and TCP traffic, to and from the Virtual Server Instances.

Create three Security Groups, one for each tier with inbound and outbound rules as follows:



 Security Group Direction Protocol Source type Source Value 

 nginx-web-sg Inbound TCP any -- ports 80-80 
 TCP any -- ports 443-443 
 Outbound any any -- -- 
 tomcat-mt-sg Inbound TCP CIDR Block vpcname-zone1web-subnet CIDR Block ports 8080-8080 
 TCP CIDR Block vpcname-zone2web-subnet ports 8080-8080 
 outgoing any any -- -- 
 mysql-db-sg Inbound TCP CIDR Block vpcname-zone1mt-subnet CIDR Block ports 3306-3306 
 TCP CIDR Block vpcname-zone2mt-subnet CIDR Block ports 3306-3306 
 TCP CIDR Block vpcname-zone2db-subnet CIDR Block ports 3306-3306 
 TCP CIDR Block vpcname-zone2db-subnet CIDR Block ports 3306-3306 
 outgoing any any -- -- 





 Note the following information: 



* Each security group accepts incoming requests from its preceding subnet and on the appropriate port. Security groups are stateful.
* No restrictions are imposed on outgoing traffic.
* The database security group is opened not only to the middle-tier incoming traffic but also from the database subnets. This arrangement takes care of database replication between the MySQL nodes.
* Opening the subnets instead of IP addresses, allows incoming traffic from any newly created Virtual Server Instances (either manually or through Auto Scaling groups) that might be added later.
* When you create Virtual Server Instances, you attach the Security Groups to the Virtual Server Instances
Click Create subnet to provision it.







 Create a security group 

To create a new security group:



1. Click Security groups under Network, then click Create.
2. Enter vpc-secure-private-sg as name and select the VPC you created earlier.
3. Click Create security group.







 Create a virtual server instance 

To create a virtual server instance in the newly created subnet:



1. Click on the subnet vpc-secure-private-subnet created earlier under Subnets.
2. Click Attached resources, under Attached instances, click Create.
3. To configure the instance:



1. Enter a unique name, vpc-secure-private-vsi and resource group as earlier.
2. Select the same Location already used by the bastion virtual server.
3. Select Public type of virtual server.
4. Set the Operating System to Ubuntu Linux. You can pick any version of the image.
5. Select Compute (2 vCPUs and 4 GB RAM) as your profile. To check other available profiles, click View all profiles.
6. For SSH keys pick the SSH key you created earlier for the bastion.



4. Scroll to Networking and select the VPC your created.
5. Under Network interfaces, click on the Edit icon



* Select vpc-secure-private-subnet as the subnet.
* Uncheck the default security and group and activate vpc-secure-private-sg.
* Click Save.



6. Click Create virtual server instance.







 Add virtual server instance(s) to the maintenance security group 

For administrative work on the servers, you have to associate the specific virtual servers with the maintenance security group. In the following, you will enable maintenance, log into the private server, update the software package information, then disassociate the security group again.

Let's enable the maintenance security group for the server.



1. Navigate to Security groups and select vpc-secure-maintenance-sg security group.
2.
ibmcloud is security-group-update GROUP [--vpc VPC] [--name NEW_NAME] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is security-group-update 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --name my-sg-renamed --output JSON
* ibmcloud is security-group-update my-sg --name my-sg-renamed --output JSON
* ibmcloud is security-group-update my-sg --vpc my-vpc --name my-sg-renamed --output JSON







 Command options 



* GROUP: ID or name of the security group.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --name: New name of the security group.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is security-groups 

List all security groups.

ibmcloud is security-groups [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME | --all-resource-groups] [--output JSON] [-q, --quiet]



 Command options 



* --resource-group-id: ID of the resource group. This ID is mutually exclusive with --resource-group-name.
* --resource-group-name: Name of the resource group. This name is mutually exclusive with --resource-group-id.
* --all-resource-groups: Query all resource groups.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.
PM-2 - Senior Information Security Officer 



  Control requirements 

PM-2 - 0
:   The organization appoints a senior information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.
For example, let's say you are part of an organization and someone with access to your organization's account modifies the default security group's policy to be different than the default policy you get when you create a new security group. Your team member is a very security-conscious customer, and they change the default security group settings to deny all inbound and outbound network traffic.

In this example, if you create a new resource, it will initially be assigned to your VPC's default security group. This default security group's policy denies all inbound and outbound network traffic because of the deny rules your security-conscious team member set up. As a result, traffic to and from your new resource will have this deny behavior applied.

Continuing with this example, if you are discontented with the default security group policy your team member set up, one solution is to create a new security group with customized settings and apply it to your resource. Another solution is to alter the policy on the default security group. Creating a new security group with customized settings is the easiest solution, because you can create rules that apply to the single resource you want to impact. If you alter the policy of the default security group, these changes will apply not only to the resource you want to impact, but to all other resources that have been assigned to the default security group.

Any new rules you create on the default security group policy will be applied to all current and future resources that are assigned to the default security group.

For more information on updating the default security group, see [Updating default security group rules](https://cloud.ibm.com/docs/vpc?topic=vpc-updating-the-default-security-groupupdating-the-default-security-group).





 Use Case 2: Customizing security groups and security group policies when creating a new resource 

The following diagram illustrates the potential customization options when you create a new resource. If a User creates a new resource and take no further action to specify a security group to attach it to, their new resource is assigned to the VPC's default security group. This default security group will take on the default security group policy or follow a customized policy previously configured by members of your account.