Microsoft/alguidelines
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

formatted nav patterns

Browse source
This commit is contained in:
christianbraeunlich 2022-02-05 18:19:26 +01:00
parent 38a19d75d8
commit 2fad891a77
59 changed files with 1403 additions and 1970 deletions
Download patch file Download diff file Expand all files Collapse all files

139
content/NAVPatterns/1-patterns/security/2-data-encryption/index.md
View file

@ -4,20 +4,12 @@ weight = 140
+++
_By Bogdana Botez at Microsoft Development Center Copenhagen_
__
_[![ ][image0]][anchor0]
_
****
[![ ][image0]][anchor0]
**Context**: After applying [**Sensitive Data Encapsulation**][anchor1], all sensitive data is gathered in a known place in the database. This makes it possible to apply further protection best practices.
**Problem**: If any non-authorized actor manages to get access to a copy of the database, the sensitive data is immediately available in clear-text.
**
**
**Forces:**
* **Accessibility:** anyone who managed to steal a copy of the database can at once read the sensitive information.
@ -30,59 +22,23 @@ Figure 1 adds one more step (in continuation of the figure in pattern **[Sensiti
_Figure 1- **Encryption** becomes easier after first applying [**Sensitive Data Encapsulation**][anchor1]._
****
**Usage**: in Dynamics NAV, codeunit 1266 Encryption Management offers an API for encryption of data. The available functionality is described in Table 1\.
Table 1- Encryption functionality in Dynamics NAV (found in codeunit 1266 Encryption Management)
**Procedure**
**Description**
**EnableEncryption**
Confirms with the user before enabling encryption in all companies of the current database.
**EnableEncryptionSilently**
Enables encryption without UI interaction (to be used for web services).
**DisableEncryption**
Disables encryption. Has a boolean "Silent" parameter which enables/disables UI interaction.
**Encrypt**
Checks that encryption is possible before encrypting the given text.
**Decrypt**
Checks that encryption is possible before decrypting the given text.
**ExportKey**
If encryption is possible, it shows a confirmation dialog to confirm the export of the encryption key, and proceeds to saving it to a location chosen by the user.
**ImportKey**
Imports the encryption key from a user chosen location.
**ChangeKey**
Changes the encryption key.
**IsEncryptionEnabled**
Returns TRUE is encryption is enabled.
**IsEncryptionPossible**
Check is the correct key is present, which only works if encryption is enabled.
**DeleteEncryptedDataInAllCompanies**
Confirms through UI and if the user agrees, deletes all data stored in the Service Password table for all companies in the current database. At the end, it deletes the encryption key.
Procedure | Description
----------|------------
EnableEncryption | Confirms with the user before enabling encryption in all companies of the current database.
EnableEncryptionSilently | Enables encryption without UI interaction (to be used for web services).
DisableEncryption | Disables encryption. Has a boolean "Silent" parameter which enables/disables UI interaction.
Encrypt | Checks that encryption is possible before encrypting the given text.
Decrypt | Checks that encryption is possible before decrypting the given text.
ExportKey | If encryption is possible, it shows a confirmation dialog to confirm the export of the encryption key, and proceeds to saving it to a location chosen by the user.
ImportKey | Imports the encryption key from a user chosen location.
ChangeKey | Changes the encryption key.
IsEncryptionEnabled | Returns TRUE is encryption is enabled.
IsEncryptionPossible | Check is the correct key is present, which only works if encryption is enabled.
DeleteEncryptedDataInAllCompanies | Confirms through UI and if the user agrees, deletes all data stored in the Service Password table for all companies in the current database. At the end, it deletes the encryption key.
**User confirmation of encryption**
@ -92,19 +48,16 @@ However, in some versions of Dynamics NAV, there are places where any user who h
To ask the security administrator if they want to enable encryption, plug the code below into the OnValidate trigger of the data field which is to be encrypted. This trigger will then get executed each time there's a change on the password field. For example, if the user is entering a password, then add a call to this procedure to Password -- OnValidate() trigger:
```al
EncryptionIsNotActivatedQst@1001 : TextConst 'ENU=Data encryption is not activated. It is recommended that you encrypt data. \\Do you want to open the Data Encryption Management window?';
LOCAL PROCEDURE CheckEncryption@6();
BEGIN
IF NOT ENCRYPTIONENABLED THEN
IF CONFIRM(EncryptionIsNotActivatedQst) THEN
PAGE.RUN(PAGE::"Data Encryption Management");
IF NOT ENCRYPTIONENABLED THEN
IF CONFIRM(EncryptionIsNotActivatedQst) THEN
PAGE.RUN(PAGE::"Data Encryption Management");
END;
```
The code above will guide the user on encrypting, storing the encryption key and choosing a safe password, as follows. Consider for example that NAV is used by a small business, where Stan is the business owner. Hence, Stan has access to all NAV setup and security decisions. Stan wants to enable a connection between NAV and CRM. In NAV, he opens page CRM Connection Setup and enters the URL, user name and password for CRM (Figure 10). When Stan leaves the password field, if data encryption is not enabled, then he sees the confirmation message in Figure 2\.
@ -157,66 +110,42 @@ In the end, Stan chooses a location for the encryption key on disk, in a standar
**References**
\[1\]
\[1\] "Wikipedia," \[Online\]. Available: https://en.wikipedia.org/wiki/Separation_of_concerns.
"Wikipedia," \[Online\]. Available: https://en.wikipedia.org/wiki/Separation\_of\_concerns.
\[2\] "GUID Structure," \[Online\]. Available: https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx.
\[2\]
\[3\] "Wikipedia," \[Online\]. Available: https://en.wikipedia.org/wiki/Binary_large_object.
"GUID Structure," \[Online\]. Available: https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx.
\[4\] waldo, "How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2".
\[3\]
\[5\] Microsoft, "Multitenant Deployment Architecture," Microsoft, \[Online\]. Available: https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx.
"Wikipedia," \[Online\]. Available: https://en.wikipedia.org/wiki/Binary\_large\_object.
\[6\] B. Botez, "Setup Table design pattern," Microsoft, 2013\. \[Online\]. Available: https://community.dynamics.com/nav/w/designpatterns/76.setup-table. \[Accessed 31 07 2016\].
\[4\]
\[7\] "Shotgun Surgery," \[Online\]. Available: https://en.wikipedia.org/wiki/Shotgun_surgery. \[Accessed 31 07 2016\].
waldo, "How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2".
\[8\] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999\.
\[5\]
\[9\] "Masking out," \[Online\]. Available: https://en.wikipedia.org/wiki/Data_masking#Masking_out. \[Accessed 29 7 2016\].
Microsoft, "Multitenant Deployment Architecture," Microsoft, \[Online\]. Available: https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx.
\[10\] "Key Vault," Microsoft, \[Online\]. Available: https://azure.microsoft.com/en-us/services/key-vault/.
\[6\]
\[11\] "How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client," Microsoft, \[Online\]. Available: https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx. \[Accessed 2 8 2016\].
B. Botez, "Setup Table design pattern," Microsoft, 2013\. \[Online\]. Available: https://community.dynamics.com/nav/w/designpatterns/76.setup-table. \[Accessed 31 07 2016\].
\[7\]
"Shotgun Surgery," \[Online\]. Available: https://en.wikipedia.org/wiki/Shotgun\_surgery. \[Accessed 31 07 2016\].
\[8\]
M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999\.
\[9\]
"Masking out," \[Online\]. Available: https://en.wikipedia.org/wiki/Data\_masking\#Masking\_out. \[Accessed 29 7 2016\].
\[10\]
"Key Vault," Microsoft, \[Online\]. Available: https://azure.microsoft.com/en-us/services/key-vault/.
\[11\]
"How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client," Microsoft, \[Online\]. Available: https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx. \[Accessed 2 8 2016\].
\[12\]
"sniffer," \[Online\]. Available: http://compnetworking.about.com/od/networksecurityprivacy/g/bldef\_sniffer.htm. \[Accessed 02 08 2016\].
\[12\] "sniffer," \[Online\]. Available: http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm. \[Accessed 02 08 2016\].
[anchor0]: Logo-_2D00_-Encryption.png
[anchor1]: /nav/w/designpatterns/275.1-sensitive-data-encapsulation
[anchor2]: /nav/w/designpatterns/275.sensitive-data-encapsulation
[anchor1]: /navpatterns/1-patterns/security/1-sensitive-data-encapsulation/
[anchor2]: /navpatterns/1-patterns/security/1-sensitive-data-encapsulation/
[anchor3]: Multi-_2D00_-1-2-3.JPG
[anchor4]: Encryption-_2D00_-1.JPG
[anchor5]: Encryption-_2D00_-2.png
[anchor6]: Encryption-_2D00_-3.png
[anchor7]: Encryption-_2D00_-4.png
[anchor8]: Encryption-_2D00_-5.png
[anchor9]: /nav/w/designpatterns/277.3-single-point-of-acces
[anchor9]: /navpatterns/1-patterns/security/3-single-point-of-access/
[image0]: Logo-_2D00_-Encryption.png