We are starting the development of an Employee Performance Review application. I am looking for some input into security design ideas. Here is the concept we are trying to develop;
A manager creates a review for the employee. The employee will not have access to the review until the manager hierarchy approves the review. Once that occurs the manager mark the review as available for the employee to view. The employee is only able to read the document except for one section where they will be able to input their comments and click a button to sign off on the review.
My question revolves around setting up security so the employee can view the managers review information at a certain point and be able to add their own comments to another section of the document.
thanks for you input
Subject: Security Ideas
Sure, look at authors/reader fields. Do not add the employee until the point of where all the management sign off on it. Also, use controlled sections, where only the managers have access to that section at the top, and have the comments section be outside the controlled access section.
Subject: RE: Security Ideas
You could alternatively decide to implement the employee comments as a response document, allowing you to separate the access control mechanisms into two different documents, which would in some ways be simpler – but of course, in terms of adding another document, also be more complex.
Subject: Security Ideas
A few points…
-
Althought author/reader fields will be necessary and useful in this application, the fact that it contains employee reviews means that you should take extra precautions. Reader fields can be bypassed using ND6’s “Full Access Administration” feature. As a result, a Domino administrator may have the ability to read all employee reviews, which could lead to catastrophic results.
-
There are two strategies to address issue 1: encryption and a dedicated server. You could use field-level encryption to cryptographically secure the review information itself, but you MUST make sure that your Domino administrator does not also have access to your users’ ID files. (And remember that there are a variety of ways that he might have such access, so be careful.) Alternatively, you could place the application on a dedicated server, to which your Domino administrators do not have access. Again, you still have to make sure they cannot access the authorized users’ ID files, because then they can simply forge access as those authorized users.
Getting this right is very tricky, and if you’re concerned about matters like legal compliance, do not hesitate to bring in a Domino security expert. Even so much as having HTTP services running on the host server could completely compromise the application.
-
You should definitely set up employee feedback to their own review as a separate response document to the review itself. Further, the management hierarchy that approves the review should also be able to respond to it as a separate document – but the employee should not be able to see these responses, even once they are allowed to see the review.
-
If you want to have the “sign off” part really hold legal validity, you’ll again need to be able to demonstrate proper controls over individual employee ID files. It’s not even enough to use Notes’ built-in cryptographic signature feature, if you can’t demonstrate that someone else could not have reasonably compromised the employee’s ID file. Also, if you use the response document to carry the signature, it MUST include the entire review copied into a rich text field on the new document itself. Otherwise, the employee has “signed” something that could be changed later.
Really, because you’re talking HR information here, you need to make sure that you’ve done everything reasonable to secure your Domino ENVIRONMENT first. Only then can you realistically talk about security on the application itself.
Subject: *I agree with Nathan on all these points. Don’t do this without thinking about it very carefully.