|
|
Can Notes be attacked by Viruses?
Here is a useful posting by ![[email]](mailto.gif)
Christopher Feller:
"...Notes is an entirely different paradigm. One of the reasons viruses and attacks on internet-based systems happen so frequently, is that the initiators are anonymous. They don't have to worry about retribution or punishment. However, you don't attack a Notes server anonymously like a Firewall or FTP server. You can't even begin to touch a Notes server unless someone has created an ID for you. And as soon as an ID exists, there's an electronic trail to follow, I don't care what fields you delete.
Someone creates an anonymous mail-bomb? Fine. I'll just trace through all the servers listed in the RouteServers field to find where the initial mail came from. Then I'll check the RouteTimes/PostedDate and compare that to the Notes Log to see when it was routed through that server. Then I'll check to see who was logged in and bust them.
Worried about attacks on your N&A? Don't give anyone greater than reader access, and control the certifier tightly. Don't let just anyone create replicas/copies on the server. Also, place a mail-paste macro that does an @DocumentDelete in the N&A. (This will keep anyone from routing anything nasty to the N&A by using Mail-In database documents or by setting the mail database destination of a user in the main or secondary N&A book to be the N&A itself.) Finally, mark all documents in the
N&A as read and check the database for unread documents on a periodic basis from the local workspace. If anything new or changed is there (even if it doesn't show up in a view) you'll find it by pressing that Tab key. (For those people who are worried about a disgruntled employee making design changes to documents or forms, inherit the N&A design from an "approved" template nightly and run a nightly background macro to check for documents that have mysterious or "non-approved" form names). Oh, and don't forget to setup statistics and event reporting!
My point is simply this: due to the way Notes was designed, access is always "granted", not implicit. So, no matter what, there's always a record of activity somewhere and there always a way to deny that access.
If you have your security set up sensibly, your logging turned up to the max, and train your users to look at buttons before pressing them (highlight the button and choose Edit->Button) then you really don't have much to worry about. If you ever do encounter anything strange, you'll be able to trace it with the information contained in the offending document. Don't let panic mongers scare you away from Notes!"