Protected key encryption is processed in the CPACF for high speeds and stored in an HSM. This key encryption enables fast encrypting and decrypting of complete disks (volumes) or selected partitions. LPAR isolation, which is standard on all LinuxONE processors for generations, virtually eliminates east-west, north-south security breaches, and their damaging effect both financially and to an organization’s credibility. 

## IBM Secure Service Container 

The IBM Secure Service Container for IBM Cloud Private (ICP) is a solution that hosts container-based applications for hybrid and private cloud workloads on IBM LinuxONE. This secure computing environment for microservices-based applications can be deployed without code changes to use the security capabilities and provides the following benefits: 

GLYPH<SM590000> Tamper protection during installation and start time to protect against malware attacks 

GLYPH<SM590000> Restricted administrator access to help prevent the misuse of privileged user credentials for cloud and on premises environments 

GLYPH<SM590000> Automatic pervasive encryption of data that is in flight and at rest 

IBM Secure Service Container adds other security capabilities for Docker and other container environments. Linux provides a comprehensive set of security technologies, including firewalls, VPNs, auditing tools to support regulatory compliance, and SELinux, which is a kernel-based security system. 

IBM Secure Service Container technology builds on the workload isolation of the firmware that is based LPARs and is unique to IBM LinuxONE. It was used in the IBM Cloud on LinuxONE to provide the advanced security of IBM Blockchain Platform and is now extended for generic container-based applications through IBM Secure Service Container for ICP. 

## 1.4.3 Using LinuxONE Security to create a secure cloud 

For more information, see CHAPTER 7 (ICP). 

Organizations can apply LinuxONE security services to their computing environments by using different methods. These services can be used as part of a private cloud or as cloud services that are hosted in ICP. For example, a client can implement an on-premises LinuxONE machine to build a private cloud, or it can gain access to the secure services by provisioning a LinuxONE instance on the cloud. 

LinuxONE servers can be configured to host the ICP software, which is a platform that integrates DevOps capabilities with cloud-optimized software. ICP on LinuxONE servers allows teams to take advantage of the IBM and open source portfolios of software by using containers and microservices in a secure cloud environment. 

Deploying an ICP environment on the LinuxONE platform allows customers to take advantage of the security capabilities of IBM’s unique en terprise server architecture. For example, customers can decide to encrypt all their data (in flight or at rest) by using pervasive encryption, and isolate containerized applications further by using IBM Secure Service Container for ICP (which automatically includes pervasive encryption) to create a highly secure environment. 

This automatic encryption protects applications and data from attacks that attempt to gain access through privileged administrator credentials. By using these security capabilities, clients can securely build and host their own hybrid and private cloud deployments on-premises. 

