Well that was different! First presentation I've been to where the two presenters seemed to publically disagree about the content - and there was a
lot of content!
Beyond giving me just enough knowledge to be dangerous (you have been warned), there was good coverage of some of the new features in versions 7, 8 and 8.5 that not only improve security but also improve the end user experience and ease some administrative burdens.
The ID Vault is still probably the biggest win, allowing us to remove some custom scripting and simplifying the initial configuration of the Notes client, but there was also information on setting up Active Directory as a "secondary directory" which we will need to look into soon.
There was also some good information on standard events that should be monitored to ensure security, and coverage of best practice configurations for all the new policies that can be configured.
One point that we will have to review is that apparently the Notes 8 client 'breaks' the roaming configuration we use at Mars (H: drive), but Notes 8.5 has the roaming ability built-in, again allowing us to remove more custom scripting
Something that was only briefly mentioned but triggered some thoughts was around categorisation of each database by Privacy and Security ratings, based on factors such as 'does the database contain consumer information' etc. We should make sure we do something around this in the upcoming database discovery work. I'm sure Jean-Marc will be thrilled!
I'll leave you with a telling comment from security professionals :
"Security is a trade-off between what users will put up with and what you need to protect your environment"
If our security colleagues are representing the side of "protecting our environment" in this trade-off, who is representing "what the users will put up with"? I don't think we have a clear answer on this yet, but i wouldn't be surprised if EUE are in the frame under the guise of the "Usability Centered Design" initiative. Expect to hear more about this!
I'll arrange for all the Lotusphere slides to be hosted internally so interested parties can view all the slides directly.