Begin the process
To begin establishing needed control in your Lotus Notes environment, here are several steps you should consider.

Create a Lotus Notes data taxonomy. Identify the different categories of data hosted by your Lotus Notes network, including business and developer ownership, security level, audience, etc. You need to establish this to ensure your Notes network and application security policies enforce this.

With the above taxonomy in mind, build a comprehensive security plan around your Notes network, including server access, user roles and permissions, individual database Access Control List practices, etc. Review the security and change management policies and procedures you already have in place for your non-Notes business systems--there's no reason why, given the right tools and insight into the particulars of Lotus Notes, you can't develop a similar system for your Notes network.

Disaster recovery is an important part of securing your Lotus Notes network and data. You need to perform a realistic and complete risk analysis, which answers, at a minimum, the following questions:

What resources am I protecting, and which resources are at risk? What's the value to the organization of those resources? What are all the possible threats those resources face? What is the likelihood of each of those threats being realized? And what would be the impact of those threats to the organization if they were realized?

If you feel external resources are needed, search for consultants with a strong track record in evaluating and creating Lotus Notes security and change management systems to help you conduct a detailed security analysis. There are also third-party tools available that bring traditional software development concepts, such as change management, build process and control, audit trails and tracking, check-in and check-out of individual design elements, and automated review of Notes applications for security and corporate standards violations.

In conclusion, let me quickly recall another incident that occurred when I worked at Lotus.

An employee had created a want-ads Notes database that other employees could use to list items or services they had for sale. One of the senior Notes developers, after reviewing the application, sent the employee an email criticizing his database for being a poor representation of Notes functionality, and reflecting poorly on the product.

Notes professionals and consultants need to recognize that their work reflects directly on Lotus Notes--end-users and other technologists who encounter your work may assume this is the very best Lotus Notes can do, and make their decisions about making use of Notes based on what you have done with the technology. The Lotus Notes development and business information environment can be just as secure and controlled as any more traditional development technology--and when this happens, then we have not just a fast business development environment; we also have an effective and reliable one.

Jesse Segovia is the president of Elanza, an interactive business solutions consulting firm specializing in the architecture, development and administration of large integrated business systems featuring Lotus Notes/Domino and the Web. He joined the Lotus Notes development team in 1989 and has been a Lotus Notes consultant since 1993.