Securing your Cloud Pak for Data environment

After you install IBM Cloud Pak for Data, complete set-up tasks to ensure that your environment is secure.

Changing the password for the default admin user
When you install an instance of IBM Cloud Pak for Data, a default administrator is created.
Applying cluster HTTP proxy settings to IBM Cloud Pak for Data
If you use HTTP proxy to manage inbound traffic to and outbound traffic from your Red Hat® OpenShift® Container Platform cluster, you can use the cpd-cli to apply the same HTTP proxy settings to an instance of IBM Cloud Pak for Data.
Customizing and securing the route to the platform
Cloud Pak for Data exposes one HTTPS port as the primary access point for the web client and API requests. On Red Hat OpenShift Container Platform, the port is exposed as an OpenShift route.
Turning off the host header injection check
By default, IBM Cloud Pak for Data rejects requests that contain invalid external routes to prevent host header injection attacks. However, if you use a load balancer and reverse proxy servers to manage host headers before requests are forwarded to Cloud Pak for Data, you must turn off the host header injection check to enable Cloud Pak for Data to accept incoming requests.
Integrating with the Identity Management Service
By default, IBM Cloud Pak for Data user records are stored in an internal repository database. However, it is strongly recommended that you use an enterprise-grade password management solution, such as single sign-on (SSO) or LDAP.
Configuring single sign-on
You can use Security Assertion Markup Language (SAML) for single sign-on (SSO) to the IBM Cloud Pak for Data web client.
Configuring vault usage
Cloud Pak for Data includes an internal vault. You can also connect to external vaults where you already store sensitive information as secrets.
Enabling users to upload JDBC drivers
JDBC driver upload is disabled by default. If you want to enable users to create Generic JDBC connections, create custom JDBC connectors, or use predefined connectors that require JDBC drivers, you must enable users to upload JDBC driver files.
Managing certificates
Set up custom TLS certificates for connecting to the platform and CA certificates to connect to internal servers from the platform.
Disabling shared credentials
An instance administrator can optionally disable the option to use shared credentials in connections in platform connections, projects, and catalogs.
Setting the idle session timeout
You can adjust the idle session timeout for IBM Cloud Pak for Data in accordance with your security and compliance requirements. If a user leaves their session idle in a web browser for the specified length of time, the user is automatically logged out of the web client.
Limiting the number of concurrent user sessions
By default, users can have an unlimited number of concurrent sessions. For example, a user could open IBM Cloud Pak for Data in 3 different web browsers and have 3 concurrent sessions. You can optionally limit the number of concurrent sessions that a user can have.
Limiting the user information that is returned by usermgmt API calls
By default, a user without the Administer platform or Manage users permission can see detailed information about other IBM Cloud Pak for Data users by running usermgmt API calls. You can set the usermgmt_limit_user_info parameter to limit the information that is returned by the API calls.
Displaying a terms and conditions prompt
If you need users to accept terms and conditions before they use the web client, you can enable a dialog that prompts users to accept the terms and conditions before they can log in to the web client. For example, you might need to enable the prompt to comply with the Federal Information Security Management Act (FISMA) regulations.
Monitoring Cloud Pak for Data user activity
User activity monitoring helps you detect and stop potentially harmful or malicious activities. If you have an RSYSLOG server, you can configure IBM Cloud Pak for Data to forward user activity information to the server.
Securing communication ports
To ensure secure transmission of network traffic to and from the Cloud Pak for Data cluster, you need to configure the communication ports used by the network.

Parent topic: Post-installation setup (Day 1 operations)