Cool feature in 7.0.2 but a big security hole. How can I restrict at the Notes level? (We don’t disable USB ports).
Thanks for any tips/suggestions!
Notes On A Stick! (New in 7.0.2)
The ability to load the Lotus Notes environment on to a USB flash drive or memory stick — Now with version 7.0.2, users can insert a memory stick loaded with their Notes environment into the USB drive on any computer, and with a few simple steps, access their Lotus Notes environment from that computer, whether Lotus Notes was previously installed there or not. When the user is finished and removes their memory stick, none of their data or the Notes icon is left exposed on the host computer.
Subject: Notes on a Stick? How can I restrict this?
Can you define the problem a little.
For example: If an IT Person had the server.id, cert.id etc and perhaps some other high level IDs, then presumably, even if they left the company they’d be able to access Notes/Domino (depending upon your password synchronisation settings).
This would depend upon them getting access to the server either within the corporate network, or - if your server was available on the internet without VPN etc - via the internet.
As far as I’m aware, Notes via USB does little to worsen this picture (it makes it a bit more portable though). It has always been possible to set yourself up with access provided that you have the relevant files.
I know that there’s a way of synching passwords to fix the problem, but I think that causes havoc if you have multiple computers.
Subject: RE: Notes on a Stick? How can I restrict this?
If the sticks are U3, then it’s less of an issue since the stick itself is password protected. If it’s lost or stolen (mine was lost), no worries since the recipient needs the PW to unlock it. If they opt to open it without the PW, everthing is deleted.
Subject: Notes on a Stick? How can I restrict this?
Steven,
FMHO, a laptop is a bigger security hole then a usb stick. On a laptop a user holds more information of the company then on a usb stick.
If you want to restrict users from using the usb stick as a notes client, you could use a “no usb client” policy instead of trying to secure the usb stick.
If a user reports a stolen usb or laptop, you could deny acces to the company by a deny acces list or turn on password checking.
Subject: Can you elaborate on how you view this as a security hole?
I assume your answer will be somethign along the lines of users being able to take data with them on the stick. But, they don’t have access to anything they don’t already have access to. For example, they could just as easily burn a CD or DVD of the databases.
Alan Lepofsky - IBM/Lotus
Learn more at my Lotus Notes Tips and Tricks Blog
LOTs of US working together to innovate for success