Front cover - IBM Redbooks

314 Lotus Security Handbook
modification of the data. Most directories are designed for significantly higher
proportions of read-operations to write-operations.
Points of control generally have access restrictions that limit or permit certain
people, servers, or applications to perform write-operations. Points of control
may be exclusive or non-exclusive. The levels of exclusivity can range from an
entire directory to a single record, or even to a single attribute. For a point of
control to be exclusive, not other point of control can overlap its scope of what
data can be written.
An example of an exclusive control point would be a process that generates a
unique employee number. The process must have the sole ability to determine
the value of this attribute, and no other interface could provide a means to modify
it. This process might fall under the control of a superior process or interface that
has the sole capability to add a new employee record.
An example of a non-exclusive control point might be a person’s nickname
attribute. The employee might have an interface and the ability to change it
themselves, in addition to other people or groups who have interfaces and
abilities to modify it, such as their manager and the HR staff.
Points of control must be identified in terms of directory, records, and attributes.
Each directory provides for various points of control, and the centralization or
decentralization of control is usually configurable to several degrees by the
implementer.
8.2.3 Data management
In the previous sections we discussed “who” can change data (the authoritative
sources), and “where” it can be changed (the points of control). Data
management is the coordination of both to avoid conflicts. Data management
also includes the data administration viewed as a whole, with the goal being
keeping the data accurate, current, and consistent. The challenges to achieving
this goal often center around the existence of multiple, independent directories
that are required to store identical or similar attributes.
Separate directories inherently provide separate points of control, so when
attributes overlap between any pairs of directories, the probability of data
inconsistency becomes quite high. The likelihood of data consistency problems
increases when the access to the different points of control is distributed to
several groups of administrators. Data consistency between any pairs of
directories can be improved by limiting the access to points of control to a
centralized administration group, but when the points of control are not
integrated, data often needs to be manually entered at each point of control.
There is always an element of human error each time data needs to be manually