Re: Lotus NOTES

Most of the security issues associated with Lotus Notes is due to bad implementation, bad setup, and lack of well thought security policies. One of the most important pre-implementation tasks is to plan how to manage the Lotus PKI (how to create and manage the certifier IDs, how to distribute and manage the private keys to users, key recovery, etc.). Another major issue many times overlooked is to not take the default access control settings for server security, databases, and templates. You need to look at each one and adjust them as needed. Proper planning is key.

IBM Redbook - Lotus Notes and Domino R5.0 Security Infrastructure Revealed:
http://publib-b.boulder.ibm.com/redbooks.nsf/RedbookAbstracts/sg245341.html?Open

Lotus security zone reference of papers and publicly known security issues:
http://www.lotus.com/developers/itcentral.nsf/wDocs/securityzone

Lotus Development Domain newsletter (look for articles regarding security):
http://www-10.lotus.com/ldd/today.nsf

Lotus Fix list database (includes the current and planned security fixes by version):
http://www-10.lotus.com/ldd/r5fixlist.nsf

Bugtraq:
http://www.securityfocus.com

Regards,
Deoscoidy Sanchez

"Bruno Mosconi" <bmosconi@fnazca.com.br> wrote on 11/28/2002 01:07:34 PM:

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

> Does anyone knows a good source of Lotus Notes security
received
> this in error, please contact the sender and delete the material from
any
> computer.
> ----------------------------------------------------------------
Received on Mon Dec 2 11:40:55 2002