Network security

Private network service endpoints

Use private network service endpoints to securely connect to endpoints over IBM private cloud, rather than connecting to resources over the public network. With Private network service endpoints, services are no longer served on an internet routable IP address and thus are more secure. Service endpoints require virtual routing and forwarding (VRF) to be enabled on your account. VRF is automatically enabled for Virtual Private Clouds (VPCs).

For more information about service endpoints, see:

• Securing connections to services with private service endpoints
• Blog: Introducing Private Service Endpoints in IBM Cloud Databases
• IBM Cloud docs: Secure access to services using service endpoints
• IBM Cloud docs: Enabling VRF and service endpoints
• IBM Cloud docs: Public and private network endpoints

Access to private data sources

Private data sources are on-premises data sources that are protected by a firewall. Cloud Pak for Data as a Service requires access through the firewall to reach the data sources. To provide secure access, you create inbound firewall rules to allow access for the IP address ranges for Cloud Pak for Data as a Service. The inbound rules are created in the configuration tool for your firewall.

See Configuring firewall access

Integrations

You can configure integrations with third-party cloud platforms to allow Cloud Pak for Data as a Service users to access data sources hosted on those clouds. The following security mechanisms apply to integrations with third-party clouds:

1. An authorized account on the third-party cloud, with appropriate permissions to view account credentials
2. Permissions to allow secure connections through the firewall of the cloud provider (for specific IP ranges)

For example, you have a data source on AWS that you are running notebooks on. You need to integrate with AWS and then generate a connection to the database. The integration and connection are secure. After you configure firewall access, you can grant appropriate permissions to users and provide them with credentials to access data.

See Integrations with other cloud platforms

Connections

Connections require valid credentials to access data. The account owner or administrator configures the type of credentials that are required, either shared or personal, at the account level. Shared credentials make the data source and its credentials accessible to all collaborators in the project. Personal credentials require each collaborator to provide their own credentials to use the data source.

Connections require valid credentials to access data. The account owner or administrator configures the type of credentials that are required at the account level. The connection creator enters a valid credential. The options are:

• Either shared or personal allows users to specify personal or shared credentials when creating a new connection by selecting a radio button and entering the correct credential.
• Personal credentials require each collaborator to provide their own credentials to use the data source.
• Shared credentials make the data source and its credentials accessible to all collaborators in the project. Users enter a common credential which was created by the creator of the connection.

For more information about connections, see:

• Adding connections to projects
• Adding data from a connection to a project
• Adding platform connections
• Managing your account settings

Connections to data behind a firewall

Secure connections provide secure communication among resources in a hybrid cloud deployment, some of which might reside behind a firewall. You have the following options for secure connections between your environment and the cloud:

• Satellite Connector
• Satellite location

VPNs

Virtual Private Networks (VPNs) create virtual point-to-point connections by using tunneling protocols, and encryption and dedicated connections. They provide a secure method for sharing data across public networks.

Following are the VPN technologies on IBM Cloud:

• IPSec VPN: The VPN facilitates connectivity from your secure network to IBM IaaS platform’s private network. Any user on the account can be given VPN access.

• VPN for VPC: With Virtual Private Cloud (VPC), you can provision generation 2 virtual server instances for VPC with high network performance.

• The Secure Gateway deprecation announcement provides information and scenarios for using VPNs as an alternative. See IBM Cloud docs: Migration options.

Allow specific IP addresses

Use this mechanism to control access to the IBM cloud console and to Cloud Pak for Data as a Service. Access is allowed from the specified IP addresses only; access from all other IP addresses is denied. You can specify the allowed IP addresses for an individual user or for an account.

When allowing specific IP addresses for watsonx.ai Studio, you must include the CIDR ranges for the watsonx.ai Studio nodes in each region (as well as the individual client system IPs that are allowed). You can include the CIDR ranges in Cloud Pak for Data as a Service by following these steps:

1. From the main menu, choose Administration > Cloud integrations.
2. Click Firewall configuration to display the IP addresses for the current region. Use CIDR notation.
3. Copy each CIDR range into the IP address restrictions for either a user or an account. Be sure to enter the allowed individual client IP addresses as well. Enter the IP addresses as a comma-separated list. Then, click Apply.
4. Repeat for each region to allow access for watsonx.ai Studio.

For step-by-step instructions for both user and account restrictions, see IBM Cloud docs: Allowing specific IP addresses

Allow third party URLs on an internal network

If you are running Cloud Pak for Data as a Service behind a firewall, you must allowlist third party URLs to provide outbound browser access. The URLs include resources from IBM Cloud and other domains. Cloud Pak for Data as a Service requires access to these domains for outbound browser traffic through the firewall.

This list provides access only for core Cloud Pak for Data as a Service functions. Specific services might require additional URLs. The list does not cover URLs required by the IBM Cloud console and its outbound requests.

Multi-tenancy

Cloud Pak for Data as a Service is hosted as a secure and compliant multi-tenant solution on IBM Cloud. See Multi-Tenant

Parent topic: Security