Network security

Network security constraints protect infrastructure, data, and applications from unauthorized network access.

Private network service endpoints

Use private network service endpoints to securely connect to endpoints over IBM private cloud, rather than connecting to resources over the public network. With Private network service endpoints, services are no longer served on an internet routable IP address and thus are more secure. Service endpoints require virtual routing and forwarding (VRF) to be enabled on your account. VRF is automatically enabled for Virtual Private Clouds (VPCs).

For more information about service endpoints, see:

• Securing connections to services with private service endpoints
• Blog: Introducing Private Service Endpoints in IBM Cloud Databases
• IBM Cloud docs: Secure access to services using service endpoints
• IBM Cloud docs: Enabling VRF and service endpoints
• IBM Cloud docs: Public and private network endpoints

Integrations

You can configure integrations with third-party cloud platforms to allow Cloud Pak for Data as a Service users to access data sources hosted on those clouds. The following security constraints apply to integrations with third-party clouds:

1. An authorized account on the third-party cloud, with appropriate permissions to view account credentials
2. Permissions to allow secure connections through the firewall of the cloud provider (for specific IP ranges)

For example, you have a data source on AWS that you are running notebooks on. You need to integrate with AWS and then generate a connection to the database. The integration and connection are secure. After you configure firewall access, you can grant appropriate permissions to users and provide them with credentials to access data.

See Integrations with other cloud platforms

Connections

Connections require valid credentials to access data. The account owner or administrator configures the type of credentials that are required, either shared or personal, at the account level. Shared credentials make the data source and its credentials accessible to all collaborators in the project. Personal credentials require each collaborator to provide their own credentials to use the data source.

For more information about connections, see:

• Adding connections to projects
• Adding data from a connection to a project
• Adding platform connections
• Managing your account settings

Secure gateway

Secure Gateway provides a secure, persistent connection between your environment and the cloud. With Secure Gateway, you can safely connect all of your applications and resources regardless of their location.

For more information, see:

• Secure Gateway on Cloud Pak for Data as a Service
• IBM Cloud docs: Getting started with Secure Gateway
• For the Secure Gateway deprecation announcement and suggested alternatives, see IBM Cloud Secure Gateway Deprecation

Satellite locations

IBM strictly manages account and resource access to Satellite locations that use access control policies, procedures, and systems. These systems allow access only to those individuals with explicit access permission.

IBM does not move data out of Satellite locations. Although the IBM control plane might reside elsewhere, the data plane (where data is processed) is located in the IBM-owned AWS account and data never leaves that location.

For more information, see Satellite locations overview

VPNs

Virtual Private Networks (VPNs) create virtual point-to-point connections using tunneling protocols, and encryption and dedicated connections. They provide a secure method for sharing data across public networks.

Following are the VPN-related technologies on IBM Cloud that provide VPN connection capability:

• IPSec VPN: The VPN facilitates connectivity from your secure network to IBM IaaS platform’s private network. Any user on the account can be given VPN access.

• VPN for VPC: With Virtual Private Cloud (VPC), you can provision generation 2 virtual server instances for VPC with high network performance.

The blog describing the deprecation of the Secure Gateway also provides information and scenarios for using VPNs as an alternative. See IBM Cloud Secure Gateway Deprecation

Allow specific IP addresses

Use this constraint to control access to the IBM cloud console and to Cloud Pak for Data as a Service. Access is allowed from the specified IP addresses only; access from all other IP addresses is denied. You can specify the allowed IP addresses for an individual user or for an account.

When allowing specific IP addresses for Watson Studio, you must include the CIDR ranges for the Watson Studio nodes in each region (as well as the individual client system IPs that are allowed). You can include the CIDR ranges in Cloud Pak for Data as a Service by following these steps:

1. From the main menu, choose Administration > Cloud integrations.
2. Click Firewall configuration to display the IP addresses for the current region. Use CIDR notation.
3. Copy each CIDR range into the IP address restrictions for either a user or an account. Be sure to enter the allowed individual client IP addresses as well. Enter the IP addresses as a comma-separated list. Then click Apply.
4. Repeat for each region to allow access for Watson Studio.

For step-by-step instructions for both user and account restrictions, see IBM Cloud docs: Allowing specific IP addresses

Multi-tenancy

Cloud Pak for Data as a Service is hosted as a secure and compliant multi-tenant solution on IBM Cloud. See Multi-Tenant

Custom network security policy

A custom network security policy restricts the external sites that users can access from Watson Studio and Watson Machine Learning. Users might access external sites to download data files or to install library packages. By default, the Watson Studio and Watson Machine Learning services do not restrict the external sites that users can access from the service. To limit access to a list of approved and secure external sites, contact IBM Cloud Support and request a custom network security policy for your organization.