SECURITY

Overview of Domino security
Setting up security for your organization is a critical task. Your security infrastructure is critical for protecting your organization's IT resources and assets. As an administrator, you need to give careful consideration to your organization's security requirements before you set up any servers or users. Upfront planning pays off later in minimizing the risks of compromised security.

Use the following tasks to guide you through your security planning:

Know the business

This is the process of understanding your organization's business requirements and the service levels that need to be met. Identify all of the components of the business, including those that are not your direct responsibility. Include new acquisitions and any recent spin-offs. As part of this process, identify the trusted network and the non-trusted network. In some cases an extranet may be an extension of a trusted network.

Once you have an understanding of the business requirements, you can then begin to plan the specifics of your IBM® Lotus® Domino® infrastructure, including:

Identify assets and threats (risk analysis)

Identify the value of the assets you are trying to protect. Applications in your organization have different values. For example, in most organizations, the availability of the e-mail infrastructure is essential to business, but instant availability of all previous e-mails is less important. Then identify the threats from an internal as well as external perspective. Make sure you understand the potential loss to your organization in the event that any one of the threats is successful. Finally, determine the probability of the threat. For example, an automated attack from a compromised system is a near certainty, a server room failure from water damage is a distinct possibility, while the theft of a server's hard drive from the data center is usually not likely.

There are many different types of threats to any computing infrastructure:

You should also understand the Lotus Domino security model, in order to better understand the Lotus Domino assets you need to protect and how they can be protected.

Develop strategies to protect your computing environment

Once you understand the potential threats to your Lotus Domino environment, you can create policies to protect each part of your Lotus Domino computing infrastructure. This may include developing policies for the following areas:

For more information on change control, see the topic "Domino Change Manager."

Develop incident handling procedures

An incident is an unplanned and unexpected event that requires immediate action to prevent a loss of business, assets, or public confidence. All security plans must have an incident handling component, as well as a feedback component for how incidents have been handled. Feedback helps to keep security plans and policies current.

Note One of the best documents that describes the importance of incident handling is the National Institute of Standards and Technology's Contingency Planning Guide for Information Technology Systems (NIST Special Publication 800-34).

Incident handling includes:

Once you have your incident-handling plans in place, you will be better able to determine your requirements for: Plan and deliver employee training

Make sure that your users know that security is everyone's responsibility. Based on your business needs, your should train your users on:

Note The National Institute of Standards and Technology published a document about the relationship among security awareness, training, and education, titled Information Technology Security Training Requirements: A Role- and Performance-Based Model (NIST Special Publication 800-16).

Keep processes current

This step is normally the most difficult, but is as critical as any of the other steps. Take the time to establish a program that will review security processes and procedures on a regular basis. Be sure to link the review to employee training. If changes are made, then employee training may need to be updated.

Related topics