Hi, we have an audit requirement of ensuring that our Domino data is encrypted at all levels possible. Already the traffic between the Notes clients and the servers is encrypted. The auditors want some kind of proof that the data is too encrypted. Database encryption seems to be out of question as it only is applicable for local databases and all our applications/databases are on the server. Document level encryption can be looked at, but the issue is that we have a number of applications with different user bases and time is something we don't afford at.
My query is "Is there any way of encrypting application on a server level? Or are they already encrypted with some basic algorithm?". Thanks in advance.
Hello,
like any other Database server, data stored inside Domino database is not encrypted (for performance and architecture reason).
This mean, if you have administrator access to server OS and some basic knowledge of NSF architecture, you can get any data you need.
Information inside databases is secured by Domino which provide strong connection encryption and authentication.
Typically this is more than ok for any audit.
Applications can't protect information if OS access is compromised/hacked.
Hi Aleksandr,
Thank you for your prompt response. Server OS security will be taken care for sure.
However, your statement "Information inside databases is secured by Domino which provide strong connection encryption and authentication." is of interest. Is there any documentation from HCL/IBM saying this? Anything documented should be fine enough.
Thanks once again.
I mean "access to information inside databases...". So any user accessing any Domino information from outside will have encrypted access.
More information about encryption and security is written in documentation:
https://www.ibm.com/support/knowledgecenter/SSKTMJ_10.0.1/admin/conf_encryption_c.html
https://www.ibm.com/support/knowledgecenter/SSKTMJ_10.0.1/admin/othr_thedominosecuritymodel_c.html
Thanks Aleksandr. Means a lot
Hello,
You could encrypt the databases on the server, so if OS access of database is compromised, the database could only be accessed with the same server id on a domino server. Otherwise you could encrypt all documents in special databases with an self created encryption key that you can distribute to other members of your organisation. They could use the same key to decrypt encrypted documents. We use such kind of encrypted data in dms app with critical information.
An administrator could have access on documents but not to the encrypted content. In my opinion this is strong enough.
Thanks Lutz, I'll look into this