anchor.diff:  
   Operators deploy Cloud Foundry with BOSH. The BOSH Director is the core orchestrating component in BOSH: it controls VM creation and deployment, as well as other software and service lifecycle events. You use HTTPS to ensure secure communication to the BOSH Director.
   
  -<p class="note"><strong>Note</strong>: <%=vars.pcf_rec%> recommends that you deploy the BOSH Director on a subnet that is not publicly accessible, and access the BOSH Director from a Jumpbox on the subnet or through VPN.</p>
  +<p class="note"><strong>Note</strong>: <%=vars.recommended_by%> recommends that you deploy the BOSH Director on a subnet that is not publicly accessible, and access the BOSH Director from a Jumpbox on the subnet or through VPN.</p>
   
   BOSH includes the following functionality for security:
   
  
positive.code: 
  ## <a id='recommendations'></a>Recommendations for Running a Secure Deployment ##
  
  To help run a secure deployment, <%=vars.pcf_rec%> recommends the following:
  
  <ul>
  <li>Configure UAA clients and users using a BOSH manifest. Limit and manage these clients and users as you would any other kind of privileged account.</li>
  
negative.code: 
  As the image below shows, in a typical deployment of Cloud Foundry, the components run on virtual machines (VMs) that exist within a VLAN. In this configuration, the only access points visible on a public network are a load balancer that maps to one or more Cloud Foundry routers and, optionally, a NAT VM and a jumpbox. Because of the limited number of contact points with the public internet, the surface area for possible security vulnerabilities is minimized.
  
  <p class="note"><strong>Note</strong>: <%=vars.recommended_by%> recommends that you also install a NAT VM for outbound requests and a Jumpbox to access the BOSH Director, though these access points are optional depending on your network configuration.</p>
  
    <%= image_tag("images/security/sysbound1.png") %>
  
  