Protected key encryption is processed in the CPACF for high speeds and stored in an HSM.  This key encryption enables fast encrypting and decrypting of complete disks (volumes) or  selected partitions. LPAR isolation, which is standard on all LinuxONE processors for  generations, virtually eliminates east-west, north-south security breaches, and their  damaging effect both financially and to an organization’s credibility. The IBM Secure Service Container for IBM Cloud Private (ICP) is a solution that hosts  container-based applications for hybrid and private cloud workloads on IBM LinuxONE. This  secure computing environment for microservices-based applications can be deployed without  code changes to use the security capabilities and provides the following benefits: IBM Secure Service Container adds other security capabilities for Docker and other container  environments. Linux provides a comprehensive set of security technologies, including  firewalls, VPNs, auditing tools to support regulatory compliance, and SELinux, which is a  kernel-based security system. IBM Secure Service Container technology builds on the workload isolation of the firmware  that is based LPARs and is unique to IBM LinuxONE. It was used in the IBM Cloud on  LinuxONE to provide the advanced security of IBM Blockchain Platform and is now extended  for generic container-based applications through IBM Secure Service Container for ICP. For more information, see CHAPTER 7 (ICP). Organizations can apply LinuxONE security services to their computing environments by  using different methods. These services can be used as part of a private cloud or as cloud  services that are hosted in ICP. For example, a client can implement an on-premises  LinuxONE machine to build a private cloud, or it can gain access to the secure services by  provisioning a LinuxONE instance on the cloud. LinuxONE servers can be configured to host the ICP software, which is a platform that  integrates DevOps capabilities with cloud-optimized software. ICP on LinuxONE servers  allows teams to take advantage of the IBM and open source portfolios of software by using  containers and microservices in a secure cloud environment.  Deploying an ICP environment on the LinuxONE platform allows customers to take advantage  of the security capabilities of IBM’s unique en terprise server architecture. For example,  customers can decide to encrypt all their data (in flight or at rest) by using pervasive  encryption, and isolate containerized applications further by using IBM Secure Service  Container for ICP (which automatically includes pervasive encryption) to create a highly  secure environment.  This automatic encryption protects applications and data from attacks that attempt to gain  access through privileged administrator credentials. By using these security capabilities,  clients can securely build and host their own hybrid and private cloud deployments  on-premises. 1.4.3 Using LinuxONE Security to create a secure cloud IBM Secure Service Container GLYPH<SM590000> Tamper protection during installation and start time to protect against malware attacks GLYPH<SM590000> Restricted administrator access to help prevent the misuse of privileged user credentials  for cloud and on premises environments GLYPH<SM590000> Automatic pervasive encryption of data that is in flight and at rest Chapter 1. IBM LinuxONE essentials  11