Securing your Cloud Pak for Data environment

After you install IBM® Cloud Pak for Data, complete set-up tasks to ensure that your environment is secure.

Changing the password for the default admin user
When you install an instance of IBM Cloud Pak for Data, the cpd-cli returns the credentials of the default admin user.
Customizing and securing the route to the platform
Cloud Pak for Data exposes one HTTPS port as the primary access point for the web client and API requests. On Red Hat® OpenShift® Container Platform, the port is exposed as an OpenShift route.
Integrating with the IAM Service
By default, IBM Cloud Pak for Data user records are stored in an internal repository database. However, it is strongly recommended that you use an enterprise-grade password management solution, such as single sign-on (SSO) or LDAP.
Migrating your LDAP configuration to the IAM Service
If you have an existing Cloud Pak for Data LDAP configuration but you want to use the Identity and Access Management Service (IAM Service), you can use the Cloud Pak for Data LDAP migration utility (cpd-cli migrate-ldap) to migrate your Cloud Pak for Data LDAP configuration and user information to the IAM Service.
Configuring single sign-on
You can use Security Assertion Markup Language (SAML) for single sign-on (SSO) to the IBM Cloud Pak for Data web client.
Configuring vault usage
Cloud Pak for Data includes an internal vault. You can also connect to external vaults where you already store sensitive information as secrets.
Managing certificates
Set up custom TLS certificates for connecting to the platform and CA certificates to connect to internal servers from the platform.
Disabling the shared credentials
A Red Hat OpenShift Container Platform project administrator can optionally disable the option to use shared credentials in connections in platform connections, projects, and catalogs.
Setting the idle session timeout
You can adjust the idle session timeout for IBM Cloud Pak for Data in accordance with your security and compliance requirements. If a user leaves their session idle in a web browser for the specified length of time, the user is automatically logged out of the web client.
Displaying a terms and conditions prompt
If you need users to accept terms and conditions before they use the web client, you can enable a dialog that prompts users to accept the terms and conditions before they can log in to the web client. For example, you might need to enable the prompt to comply with the Federal Information Security Management Act (FISMA) regulations.
Securing communication ports
To ensure secure transmission of network traffic to and from the Cloud Pak for Data cluster, you need to configure the communication ports used by the network.

Parent topic: Post-installation setup (Day 1 operations)