Front cover - IBM Redbooks

104 Lotus Security Handbook
Once your IT infrastructure serves users outside your organization, the situation
changes. The internet allows your organization to do business with people that
you do not know. Your organization has to answer difficult questions:
► How can people's identities be confirmed?
► When you collect and store information about people, how is the information
kept private?
► When you collect information about people, how is the information used?
Data confidentiality or data integrity mechanisms, or both, must be used to
protect important data that flows through the Internet, including information that
identifies people, their credit card information, order or contractual information,
and so forth. Therefore, our recommendation is to treat all user identities and
credentials (such as passwords, challenge question responses, certificates) as
confidential information. This includes both your internal users as well as your
external users. Privacy laws vary in different countries, and often dictate specific
requirements for storage and safeguarding of employee, contractor, business
partner, customer, and supplier information. It is your responsibility to ensure
compliance with all applicable privacy laws; legal advice is well outside the scope
of this book.
Once a party is identified, the second half of the equation is to determine what
systems and data that user is permitted to access and what functions may be
performed. Access controls are governed by three major security principles:
1. Accountability: The ability to trace all system activities to the person who
initiated the action. This has the proactive result of ensuring that users know
anonymous activity is not possible (greatly reducing the temptation to browse
or misuse the system), and enables the reconstruction of the activities leading
to a security incident.
2. Least privilege: The goal of providing users with only that set of privileges
necessary to the performance of each user's authorized duties. This helps
reduce the not uncommon chain of: curiosity, browsing, discovery, fascination,
temptation, and ultimately improper action. “Need to know” is an aspect of
least privilege.
3. Separation of duties: The goal of ensuring that no single person is in a
position to perform, approve, and account for any security-critical action. The
primary goal is not to allow the actions of a single individual to introduce a
single point of failure.
Utilize proxy systems
Utilizing “proxy systems” can provide protection to back-end applications and
Web servers. Think of a proxy as a type of firewall that goes beyond the TCPIP
level. They are sometimes referred to as “application gateways,” although this