Recording: http://pan.news/20210316 Abstract: Did you make fast changes to support remote work for your users? Well, you are not alone. A huge number of employees are working from home right now. Still they need access to information stored behind the company firewalls. They also keep much of this data on devices outside of your control, prone to loss and theft. But are businesses ready to operate this way forever? Attention is now shifting to security concerns. Remote work is now evolving from a temporary to a common solution. Nearly all companies are now considering the underlying security risks involved. HCL Notes has the well-earned reputation of being an ironclad platform. It was purpose-built for these scenarios. However, you need to configure it correctly to benefit from its powerful security features. The key question is this: Are you SURE you haven't overlooked something in YOUR environment? We will present the best security measures for Notes clients. Let's make remote work sustainable for 2021 and beyond. The webinar will cover the following topics: - The basics of securing your Notes and Nomad clients - Secure client-server communication over any port (with and without SafeLinx) - Safeguarding data in local replicas - Protecting the client environment from running untrusted code - Staying current with security updates Speaker: Chris Adler

1. Make Your Data Work For You
Best Practices for HCL Notes/Domino Security
Part 1: The Notes Client
16th March 2021

2. Daniel Klas
@panagenda
Inbound Marketing Coordinator
panagenda
Christoph Adler
@cadler80
Senior Consultant
panagenda
Join the conversation using #NotesDominoSecurity & @panagenda
Speakers

3. Agenda
1. Introduction
2. Secure client-server communication over any port (with and without SafeLinx)
3. Safeguarding data in local replicas/databases
4. Protecting the client environment from running untrusted code
5. Staying current with security updates
6. Authentication security

5. 1. Introduction – Available clients
• Available clients
– HCL Notes – Basic configuration
– HCL Notes – Standard (incl. Eclipse)
– HCL Notes – Standard (incl. Eclipse + Admin and/or Designer client)
– HCL Client Application Access – aka HCAA
– HCL Nomad – mobile app for Android
– HCL Nomad – mobile app for iOS/iPadOS
– HCL Nomad Web (beta) – via Browser
– HCL Verse – via Browser

6. 2. Secure client-server communication – Client
• NRPC port settings
– NRPC = Notes remote procedure call
– Port 1352
– Legacy
• LAN0 / COM(.*) / DisabledPorts
→ Should be removed
– Port settings in notes.ini
• Ports=TCPIP
• TCPIP = TCP,0,15,0,,45056,
→ with encryption only
• TCPIP = TCP,0,15,0,,45088,
→ with encryption & compression
• TCPIP = TCP,0,15,0,,12288,
→ DEFAULT - without encryption & compression

7. 2. Secure client-server communication – Server
• Legacy/Default port encryption for Notes/Domino
– RC4 128Bit (Rivest Cipher 4)
• Best practice settings for port encryption on Domino server >= 9.0.1 Fix Pack 7
– AES-GCM 128Bit (Advanced Encryption Standard)
– notes.ini → PORT_ENC_ADV=84
• See the following Technote for details and read before you use the parameter:
– https://help.hcltechsw.com/domino/11.0.1/admin/conf_port_enc_adv_r.html

8. 2. Secure client-server communication – mobile app
• HCL Nomad mobile app
– Classic → NRPC (direct using VPN/Passthrough)
– New → SSL Tunneling (port 443) using Nomad Proxy aka HCL SafeLinx

9. 3. Safeguarding data in local replicas/databases
• Local replicas of (Domino) server databases
– One of the most powerful features of Notes/Domino is “Replication”
– Almost every customer has local replicas on some or on all Notes clients
(managed and/or unmanaged)
– Local replicas in general should always be encrypted
– Use “Strong Encryption” or even better “128 bit AES”

10. 3. Safeguarding data in local replicas/databases (cont.)
• Access Control List (ACL) of local replicas
– Use the option “Enforce a consistent Access Control List” in the ACL’s of your server Application
Databases to ensure ACL is identical on all replicas (incl. local).

11. 4. Protecting the client environment from running untrusted code
• Execution Control List (ECL)
– The ECL takes care that code only gets executed if the “code signer” is trusted
– Either a user or admins can put “signers/users” on the ECL
– Using an Administration-ECLor manage the ECL (incl. lock down) is highly recommendedand also
ensures that a user cannot add users/Signers to the list
• If a user then gets an “Execution Security Alert” → it is a security alert!

12. 5. Staying current with security updates
• Do you remember our first slide?
• Available clients
– HCL Notes – Basic configuration
– HCL Notes – Standard (incl. Eclipse)
– HCL Notes – Standard (incl. Eclipse + Admin and/or Designer client)
– HCL Client Application Access – aka HCAA
– HCL Nomad – mobile app for Android
– HCL Nomad – mobile app for iOS/iPadOS
– HCL Nomad Web (beta) – via Browser
– HCL Verse – via Browser

13. 5. Staying current with security updates (cont.)
• Do you remember our first slide?
• Available clients and latest releases
– HCL Notes 11.0.1 FP2 SHF46 – Basic configuration
– HCL Notes 11.0.1 FP2 SHF46 – Standard (incl. Eclipse)
– HCL Notes 11.0.1 FP2 SHF46 – Standard (incl. Eclipse + Admin and/or Designer client)
– HCL Client Application Access 3.0.3 – aka HCAA
– HCL Nomad 1.0.15 20210219-1541 – mobile app for Android
– HCL Nomad 1.0.11– mobile app for iOS/iPadOS
– HCL Nomad Web (beta) – via Browser
– HCL Verse 2.0.1 – via Browser

14. 5. Staying current with security updates (cont.)
• More security options
– The newer the version, the more modern and better the security options and features
• Vulnerability
– The older the version, the higher the risk of being vulnerable
– Check out this link (sorted in ascending order by date):
https://support.hcltechsw.com/csm?id=kb_search&spa=1&language=en&u_document_type=Security%20B
ulletin&kb_category=1ec026dc1b45730083cb86e9cd4bcb24

15. 6. Authentication security
• The following may sound silly, but
– PLEASE use ID files protected with passwords
– Use a Security-Policy to force password
• expiration after xx days
• complexity
• Single Sign-On (SSO) may help here
– Comfort combined with security
– Notes Shared Login (NSL)
• https://help.hcltechsw.com/domino/11.0.1/admin/conf_usingnotessharedlogintosuppresspasswordpr
ompts_c.html
– Notes Federated Login (NFL)
• https://help.hcltechsw.com/domino/11.0.1/admin/secu_using_security_assertion_markup_language_saml
_to_configure_federated_identity_authentication_t.html?hl=federated%2Clogin

16. - Commercial break -
All the 6 topics and more can be easily covered/solved/managed by

17. Daniel Klas
@panagenda
Inbound Marketing Coordinator
panagenda
Christoph Adler
@cadler80
Senior Consultant
panagenda
Join the conversation using #NotesDominoSecurity & @panagenda
Q & A

18. Daniel Klas
@panagenda
Inbound Marketing Coordinator
panagenda
Christoph Adler
@cadler80
Senior Consultant
panagenda
Join the conversation using #NotesDominoSecurity & @panagenda
Thank you!

19. Daniel Klas
@panagenda
Inbound Marketing Coordinator
panagenda
Christoph Adler
@cadler80
Senior Consultant
panagenda
Join the conversation using #NotesDominoSecurity & @panagenda
Thank you!