Microsoft/alguidelines
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

deploy: 9e06f72056

Browse source
This commit is contained in:
TheDoubleH 2022-02-11 17:30:04 +00:00
parent de09820554
commit e4f08bf9a7
187 changed files with 6620 additions and 6342 deletions
Download patch file Download diff file Expand all files Collapse all files

94
navpatterns/1-patterns/security/1-sensitive-data-encapsulation/index.html
View file

@ -5,16 +5,16 @@
<meta name=generator content="Hugo 0.92.1">
<meta name=description content>
<title>Sensitive Data Encapsulation :: AL Guidelines</title>
<link href=/css/nucleus.css?1644506469 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644506469 rel=stylesheet>
<link href=/css/featherlight.min.css?1644506469 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644506469 rel=stylesheet>
<link href=/css/auto-complete.css?1644506469 rel=stylesheet>
<link href=/css/theme.css?1644506469 rel=stylesheet>
<link href=/css/theme-blue.css?1644506469 rel=stylesheet>
<link href=/css/variant.css?1644506469 rel=stylesheet>
<link href=/css/print.css?1644506469 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644506469></script>
<link href=/css/nucleus.css?1644600599 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644600599 rel=stylesheet>
<link href=/css/featherlight.min.css?1644600599 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644600599 rel=stylesheet>
<link href=/css/auto-complete.css?1644600599 rel=stylesheet>
<link href=/css/theme.css?1644600599 rel=stylesheet>
<link href=/css/theme-blue.css?1644600599 rel=stylesheet>
<link href=/css/variant.css?1644600599 rel=stylesheet>
<link href=/css/print.css?1644600599 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644600599></script>
<style>:root #header+#content>#left>#rlblock_left{display:none!important}</style>
</head>
<body data-url=/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/>
@ -32,9 +32,9 @@ ALGuidelines.Dev
<input data-search-input id=search-by type=search placeholder=Search...>
<span data-search-clear><i class="fas fa-times"></i></span>
</div>
<script src=/js/lunr.min.js?1644506469></script>
<script src=/js/auto-complete.js?1644506469></script>
<script src=/js/search.js?1644506469></script>
<script src=/js/lunr.min.js?1644600599></script>
<script src=/js/auto-complete.js?1644600599></script>
<script src=/js/search.js?1644600599></script>
</div>
<div class=highlightable>
<ul class=topics>
@ -256,17 +256,10 @@ ALGuidelines.Dev
<main id=body-inner>
<h1>Sensitive Data Encapsulation</h1>
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
<p>_<br>
_</p>
<p><a href=Logo-_2D00_-Protected-Data-Encapsulation.png><img src=Logo-_2D00_-Protected-Data-Encapsulation.png alt=" "></a></p>
<p>**<br>
**</p>
<p><strong>Aliases:</strong> Encapsulation, Separation of Concerns [1]</p>
<p>**<br>
**</p>
<p><strong>Context</strong>: You want to store and protect sensitive data which already exists in a system, but it is not clear which data needs protection and how to store it.</p>
<p><strong>Problem</strong>: Sensitive data is scattered and mixed with other data in various parts of the system (passwords residing in the same table with non-sensitive data, part of the private information might be stored in files, hardcoded text constants, hardcoded info as part of the code etc.).</p>
<hr>
<p><strong>Forces:</strong></p>
<ul>
<li><strong>Obscurity:</strong> sensitive data mixed with other data and code makes it hard to have an overview of what needs to be protected.</li>
@ -276,16 +269,14 @@ _</p>
<li><strong>Low</strong> <strong>Performance</strong>: protecting all data can slow down the system.</li>
</ul>
<p><strong>Solution:</strong> Extract and separate sensitive data into a single known repository.</p>
<p>To apply this pattern in Dynamics NAV, a table structure similar to Table 1261 Service Password can be used. The Service Password table also contains additional functionality which will help to further apply related patterns like <a href=/nav/w/designpatterns/277.3-single-point-of-acces><strong>Access Control</strong></a> and <a href=/nav/w/designpatterns/276.2-data-encryption><strong>Encryption</strong></a>.</p>
<p>To apply this pattern in Dynamics NAV, a table structure similar to Table 1261 Service Password can be used. The Service Password table also contains additional functionality which will help to further apply related patterns like <a href=/navpatterns/1-patterns/security/3-single-point-of-access/><strong>Access Control</strong></a> and <a href=/navpatterns/1-patterns/security/2-data-encryption/><strong>Encryption</strong></a>.</p>
<p>Figure 1 describes the definition of a table which is already available in Dynamics NAV. This table can be used for storing sensitive data. As a minimum, the table only needs two fields:</p>
<ol>
<li>The key is of type GUID (Globally Unique Identifier), which is a 128-bit value consisting of multiple groups of hexadecimal digits [2]. Each key needs to be unique and will be used for storing and retrieving the protected information.</li>
<li>The value (the actual data to be encapsulated) is of type BLOB (Binary Large OBject) [3], which contains the encrypted or un-encrypted data (for encryption, see the related <a href=/nav/w/designpatterns/276.2-data-encryption><strong>Encryption</strong></a> pattern).</li>
<li>The value (the actual data to be encapsulated) is of type BLOB (Binary Large OBject) [3], which contains the encrypted or un-encrypted data (for encryption, see the related <a href=/navpatterns/1-patterns/security/2-data-encryption/><strong>Encryption</strong></a> pattern).</li>
</ol>
<p><a href=Data-Encapsulation-_2D00_-figure-1.png><img src=Data-Encapsulation-_2D00_-figure-1.png alt="Figure 1- Example definition, table used for Data Encapsulation"></a></p>
<p><em>Figure 1- Example definition, table used for <strong>Sensitive</strong> <strong>Data</strong> <strong>Encapsulation</strong></em></p>
<p>**<br>
**</p>
<p>Let&rsquo;s use a software system (which can be a Dynamics NAV extension or customization). Chances are that the system will look similar to the one described in part 1 of Figure 2: there is data handled in various places of the system, on various storage solutions. Intertwined with normal data, there is sensitive data. For example: Dynamics CRM (Customer Relationship Management) connection information could be all stored in one table, and consists of the connection URI (normal data), enabled/disabled status (normal data), and connection password (sensitive data).</p>
<p>Figure 2 illustrates the system before and after applying the <strong>Sensitive Data Encapsulation</strong> pattern.</p>
<ul>
@ -303,46 +294,33 @@ _</p>
</ul>
<p><a href=Multi-_2D00_-1-2.JPG><img src=Multi-_2D00_-1-2.JPG alt=" "></a></p>
<p><em>Figure 2 - Data access before and after <strong>Sensitive</strong> <strong>Data</strong> <strong>Encapsulation.</strong></em></p>
<p>.</p>
<p><strong>Benefits:</strong></p>
<ul>
<li><strong>Clarity:</strong> when all sensitive data is encapsulated in one place, it is clear which is the information that needs to be protected.</li>
<li><strong>Simplicity:</strong> easier to protect just a limited number of known resources when they are grouped.</li>
<li>**Homogeneity: **the same protection can be applied to all data, since it is stored in the same place.</li>
<li><strong>Homogeneity:</strong> the same protection can be applied to all data, since it is stored in the same place.</li>
<li><strong>Separation of concerns:</strong> treat each section of the computer program differently, by separating it and clearly addressing its own requirements and limitations. [1]</li>
<li><strong>Performance</strong>: data protection techniques like <strong>Access Control</strong> and <strong>Encryption</strong> can now be applied only to the sensitive data (not to everything), which improves the performance of the system.</li>
</ul>
<p><strong>Drawbacks:</strong></p>
<ul>
<li><strong>Single point of failure:</strong> a maliciously intended actor has no longer a need to reverse engineer the places where important data is stored. In the unwanted situation when this actor would have already obtained access to the system, they can more easily locate the sensitive information. This is a step towards information disclosure, but mechanisms like <a href=/nav/w/designpatterns/276.2-data-encryption><strong>Encryption</strong></a> and logging can provide further protection.</li>
<li><strong>Single point of failure:</strong> a maliciously intended actor has no longer a need to reverse engineer the places where important data is stored. In the unwanted situation when this actor would have already obtained access to the system, they can more easily locate the sensitive information. This is a step towards information disclosure, but mechanisms like <a href=/navpatterns/1-patterns/security/2-data-encryption/><strong>Encryption</strong></a> and logging can provide further protection.</li>
<li><strong>Limited Text Length</strong>: there is a limit on how long the encrypted text can be. This limit is imposed by the OS encryption service and it depends on the composition of the text as well as on the system specifics. In NAV, we had implemented the Encrypted Text for text values of max 250 chars, which is enough to cover passwords, person ID numbers, credit card info, but it might turn insufficient in other future scenarios.</li>
<li><strong>Nomenclature</strong>: the name of the table <strong>Service Password</strong> is too specific, since it started by being used for passwords, but it has the capability and it now contains other sensitive data like API Keys, credit card numbers etc.</li>
</ul>
<p><strong>References</strong></p>
<p>[1]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation>https://en.wikipedia.org/wiki/Separation</a>_of_concerns.</p>
<p>[2]</p>
<p>&ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary>https://en.wikipedia.org/wiki/Binary</a>_large_object.</p>
<p>[4]</p>
<p>waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5]</p>
<p>Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6]</p>
<p>B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7]</p>
<p>&ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun>https://en.wikipedia.org/wiki/Shotgun</a>_surgery. [Accessed 31 07 2016].</p>
<p>[8]</p>
<p>M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9]</p>
<p>&ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data>https://en.wikipedia.org/wiki/Data</a>_masking#Masking_out. [Accessed 29 7 2016].</p>
<p>[10]</p>
<p>&ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11]</p>
<p>&ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12]</p>
<p>&ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef</a>_sniffer.htm. [Accessed 02 08 2016].</p>
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation_of_concerns>https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary_large_object>https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun_surgery>https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data_masking#Masking_out>https://en.wikipedia.org/wiki/Data_masking#Masking_out</a>. [Accessed 29 7 2016].</p>
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p>
<footer class=footline>
</footer>
</main>
@ -355,12 +333,12 @@ _</p>
<div style=left:-1000px;overflow:scroll;position:absolute;top:-1000px;border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px>
<div style=border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px></div>
</div>
<script src=/js/clipboard.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644506469></script>
<script src=/js/jquery.svg.pan.zoom.js?1644506469></script>
<script src=/js/featherlight.min.js?1644506469></script>
<script src=/js/modernizr.custom-3.6.0.js?1644506469></script>
<script src=/js/relearn.js?1644506469></script>
<script src=/js/clipboard.min.js?1644600599></script>
<script src=/js/perfect-scrollbar.min.js?1644600599></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644600599></script>
<script src=/js/jquery.svg.pan.zoom.js?1644600599></script>
<script src=/js/featherlight.min.js?1644600599></script>
<script src=/js/modernizr.custom-3.6.0.js?1644600599></script>
<script src=/js/relearn.js?1644600599></script>
</body>
</html>

187
navpatterns/1-patterns/security/2-data-encryption/index.html
View file

@ -5,16 +5,16 @@
<meta name=generator content="Hugo 0.92.1">
<meta name=description content>
<title>Data Encryption :: AL Guidelines</title>
<link href=/css/nucleus.css?1644506469 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644506469 rel=stylesheet>
<link href=/css/featherlight.min.css?1644506469 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644506469 rel=stylesheet>
<link href=/css/auto-complete.css?1644506469 rel=stylesheet>
<link href=/css/theme.css?1644506469 rel=stylesheet>
<link href=/css/theme-blue.css?1644506469 rel=stylesheet>
<link href=/css/variant.css?1644506469 rel=stylesheet>
<link href=/css/print.css?1644506469 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644506469></script>
<link href=/css/nucleus.css?1644600599 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644600599 rel=stylesheet>
<link href=/css/featherlight.min.css?1644600599 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644600599 rel=stylesheet>
<link href=/css/auto-complete.css?1644600599 rel=stylesheet>
<link href=/css/theme.css?1644600599 rel=stylesheet>
<link href=/css/theme-blue.css?1644600599 rel=stylesheet>
<link href=/css/variant.css?1644600599 rel=stylesheet>
<link href=/css/print.css?1644600599 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644600599></script>
<style>:root #header+#content>#left>#rlblock_left{display:none!important}</style>
</head>
<body data-url=/navpatterns/1-patterns/security/2-data-encryption/>
@ -32,9 +32,9 @@ ALGuidelines.Dev
<input data-search-input id=search-by type=search placeholder=Search...>
<span data-search-clear><i class="fas fa-times"></i></span>
</div>
<script src=/js/lunr.min.js?1644506469></script>
<script src=/js/auto-complete.js?1644506469></script>
<script src=/js/search.js?1644506469></script>
<script src=/js/lunr.min.js?1644600599></script>
<script src=/js/auto-complete.js?1644600599></script>
<script src=/js/search.js?1644600599></script>
</div>
<div class=highlightable>
<ul class=topics>
@ -256,61 +256,86 @@ ALGuidelines.Dev
<main id=body-inner>
<h1>Data Encryption</h1>
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
<p>__</p>
<p>_<a href=Logo-_2D00_-Encryption.png><img src=Logo-_2D00_-Encryption.png alt=" "></a><br>
_</p>
<hr>
<p><strong>Context</strong>: After applying <a href=/nav/w/designpatterns/275.1-sensitive-data-encapsulation><strong>Sensitive Data Encapsulation</strong></a>, all sensitive data is gathered in a known place in the database. This makes it possible to apply further protection best practices.</p>
<p><a href=Logo-_2D00_-Encryption.png><img src=Logo-_2D00_-Encryption.png alt=" "></a></p>
<p><strong>Context</strong>: After applying <a href=/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/><strong>Sensitive Data Encapsulation</strong></a>, all sensitive data is gathered in a known place in the database. This makes it possible to apply further protection best practices.</p>
<p><strong>Problem</strong>: If any non-authorized actor manages to get access to a copy of the database, the sensitive data is immediately available in clear-text.</p>
<p>**<br>
**</p>
<p><strong>Forces:</strong></p>
<ul>
<li><strong>Accessibility:</strong> anyone who managed to steal a copy of the database can at once read the sensitive information.</li>
</ul>
<p><strong>Solution:</strong> Encrypt sensitive data. Dynamics NAV offers a simple mechanism for data encryption, to be used by NAV developers.</p>
<p>Figure 1 adds one more step (in continuation of the figure in pattern <strong><a href=/nav/w/designpatterns/275.sensitive-data-encapsulation>Sensitive Data Encapsulation</a></strong>), in which the first two panels describe how sensitive data has all been gathered in one known place. This makes the current pattern, <strong>Encryption</strong>, much easier &ndash; since now data needs to be encrypted in only one place. The last panel of Figure 1 shows the system after the next step, <strong>Encryption</strong>, has been implemented. This shows the iterative process of applying patterns and making the code better step by step.</p>
<p>Figure 1 adds one more step (in continuation of the figure in pattern <strong><a href=/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/>Sensitive Data Encapsulation</a></strong>), in which the first two panels describe how sensitive data has all been gathered in one known place. This makes the current pattern, <strong>Encryption</strong>, much easier &ndash; since now data needs to be encrypted in only one place. The last panel of Figure 1 shows the system after the next step, <strong>Encryption</strong>, has been implemented. This shows the iterative process of applying patterns and making the code better step by step.</p>
<p><a href=Multi-_2D00_-1-2-3.JPG><img src=Multi-_2D00_-1-2-3.JPG alt=" "></a></p>
<p><em>Figure 1- <strong>Encryption</strong> becomes easier after first applying <a href=/nav/w/designpatterns/275.1-sensitive-data-encapsulation><strong>Sensitive Data Encapsulation</strong></a>.</em></p>
<hr>
<p><em>Figure 1- <strong>Encryption</strong> becomes easier after first applying <a href=/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/><strong>Sensitive Data Encapsulation</strong></a>.</em></p>
<p><strong>Usage</strong>: in Dynamics NAV, codeunit 1266 Encryption Management offers an API for encryption of data. The available functionality is described in Table 1.</p>
<p>Table 1- Encryption functionality in Dynamics NAV (found in codeunit 1266 Encryption Management)</p>
<p><strong>Procedure</strong></p>
<p><strong>Description</strong></p>
<p><strong>EnableEncryption</strong></p>
<p>Confirms with the user before enabling encryption in all companies of the current database.</p>
<p><strong>EnableEncryptionSilently</strong></p>
<p>Enables encryption without UI interaction (to be used for web services).</p>
<p><strong>DisableEncryption</strong></p>
<p>Disables encryption. Has a boolean &ldquo;Silent&rdquo; parameter which enables/disables UI interaction.</p>
<p><strong>Encrypt</strong></p>
<p>Checks that encryption is possible before encrypting the given text.</p>
<p><strong>Decrypt</strong></p>
<p>Checks that encryption is possible before decrypting the given text.</p>
<p><strong>ExportKey</strong></p>
<p>If encryption is possible, it shows a confirmation dialog to confirm the export of the encryption key, and proceeds to saving it to a location chosen by the user.</p>
<p><strong>ImportKey</strong></p>
<p>Imports the encryption key from a user chosen location.</p>
<p><strong>ChangeKey</strong></p>
<p>Changes the encryption key.</p>
<p><strong>IsEncryptionEnabled</strong></p>
<p>Returns TRUE is encryption is enabled.</p>
<p><strong>IsEncryptionPossible</strong></p>
<p>Check is the correct key is present, which only works if encryption is enabled.</p>
<p><strong>DeleteEncryptedDataInAllCompanies</strong></p>
<p>Confirms through UI and if the user agrees, deletes all data stored in the Service Password table for all companies in the current database. At the end, it deletes the encryption key.</p>
<table>
<thead>
<tr>
<th>Procedure</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>EnableEncryption</td>
<td>Confirms with the user before enabling encryption in all companies of the current database.</td>
</tr>
<tr>
<td>EnableEncryptionSilently</td>
<td>Enables encryption without UI interaction (to be used for web services).</td>
</tr>
<tr>
<td>DisableEncryption</td>
<td>Disables encryption. Has a boolean &ldquo;Silent&rdquo; parameter which enables/disables UI interaction.</td>
</tr>
<tr>
<td>Encrypt</td>
<td>Checks that encryption is possible before encrypting the given text.</td>
</tr>
<tr>
<td>Decrypt</td>
<td>Checks that encryption is possible before decrypting the given text.</td>
</tr>
<tr>
<td>ExportKey</td>
<td>If encryption is possible, it shows a confirmation dialog to confirm the export of the encryption key, and proceeds to saving it to a location chosen by the user.</td>
</tr>
<tr>
<td>ImportKey</td>
<td>Imports the encryption key from a user chosen location.</td>
</tr>
<tr>
<td>ChangeKey</td>
<td>Changes the encryption key.</td>
</tr>
<tr>
<td>IsEncryptionEnabled</td>
<td>Returns TRUE is encryption is enabled.</td>
</tr>
<tr>
<td>IsEncryptionPossible</td>
<td>Check is the correct key is present, which only works if encryption is enabled.</td>
</tr>
<tr>
<td>DeleteEncryptedDataInAllCompanies</td>
<td>Confirms through UI and if the user agrees, deletes all data stored in the Service Password table for all companies in the current database. At the end, it deletes the encryption key.</td>
</tr>
</tbody>
</table>
<p><strong>User confirmation of encryption</strong></p>
<p>Ideally, encryption should be enabled by default.</p>
<p>However, in some versions of Dynamics NAV, there are places where any user who happens to hit a sensitive field (like a password) is asked if they want to encrypt or not. If user confirmation is needed, then let only the security administrators decide (not any random user).</p>
<p>To ask the security administrator if they want to enable encryption, plug the code below into the OnValidate trigger of the data field which is to be encrypted. This trigger will then get executed each time there&rsquo;s a change on the password field. For example, if the user is entering a password, then add a call to this procedure to Password &ndash; OnValidate() trigger:</p>
<p>EncryptionIsNotActivatedQst@1001 : TextConst &lsquo;ENU=Data encryption is not activated. It is recommended that you encrypt data. \Do you want to open the Data Encryption Management window?';</p>
<p>LOCAL PROCEDURE CheckEncryption@6();</p>
<p>BEGIN</p>
<p>IF NOT ENCRYPTIONENABLED THEN</p>
<p>IF CONFIRM(EncryptionIsNotActivatedQst) THEN</p>
<p>PAGE.RUN(PAGE::&ldquo;Data Encryption Management&rdquo;);</p>
<p>END;</p>
<p>The code above will guide the user on encrypting, storing the encryption key and choosing a safe password, as follows. Consider for example that NAV is used by a small business, where Stan is the business owner. Hence, Stan has access to all NAV setup and security decisions. Stan wants to enable a connection between NAV and CRM. In NAV, he opens page CRM Connection Setup and enters the URL, user name and password for CRM (Figure 10). When Stan leaves the password field, if data encryption is not enabled, then he sees the confirmation message in Figure 2.</p>
<div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-al data-lang=al>EncryptionIsNotActivatedQst@<span style=color:#ae81ff>1001</span> : <span style=color:#66d9ef>TextConst</span> <span style=color:#e6db74>&#39;ENU=Data encryption is not activated. It is recommended that you encrypt data. \\Do you want to open the Data Encryption Management window?&#39;</span>;
<span style=color:#66d9ef>LOCAL</span> <span style=color:#66d9ef>PROCEDURE</span> CheckEncryption@<span style=color:#ae81ff>6</span><span style=color:#f92672>()</span>;
<span style=color:#66d9ef>BEGIN</span>
<span style=color:#66d9ef>IF</span> <span style=color:#f92672>NOT</span> ENCRYPTIONENABLED <span style=color:#66d9ef>THEN</span>
<span style=color:#66d9ef>IF</span> CONFIRM<span style=color:#f92672>(</span>EncryptionIsNotActivatedQst<span style=color:#f92672>) </span><span style=color:#66d9ef>THEN</span>
<span style=color:#66d9ef>PAGE</span><span style=color:#f92672>.</span>RUN<span style=color:#f92672>(</span><span style=color:#66d9ef>PAGE</span>::&#34;Data Encryption Management&#34;<span style=color:#f92672>)</span>;
<span style=color:#66d9ef>END</span>;
</code></pre></div><p>The code above will guide the user on encrypting, storing the encryption key and choosing a safe password, as follows. Consider for example that NAV is used by a small business, where Stan is the business owner. Hence, Stan has access to all NAV setup and security decisions. Stan wants to enable a connection between NAV and CRM. In NAV, he opens page CRM Connection Setup and enters the URL, user name and password for CRM (Figure 10). When Stan leaves the password field, if data encryption is not enabled, then he sees the confirmation message in Figure 2.</p>
<p><a href=Encryption-_2D00_-1.JPG><img src=Encryption-_2D00_-1.JPG alt=" "></a></p>
<p><em>Figure 2- The administrator is advised to enable encryption.</em></p>
<p>Now Stan becomes aware that there is no encryption and has the opportunity to enable it. If he clicks on &ldquo;Yes&rdquo;, Stan will be taken to the Data Encryption Management page (Figure 3).</p>
@ -340,34 +365,22 @@ _</p>
<p><strong>Anti-patterns:</strong></p>
<ul>
<li><strong>Performance:</strong> Do not encrypt everything, because it will have a performance impact on the system. Only important information should be encrypted.</li>
<li><strong>System calls and &ldquo;Do It Yourself&rdquo; solutions</strong>: Although system calls for encryptions are available in NAV (ENCRYPT, DECRYPT and &lt;action>ENCRYPTIONKEY), unless there is no other way, refrain from using them directly. Use instead he API in codeunit 1266 Encryption Management, which is safer to use, because it protects against common mistakes (like attempting to encrypt an already encrypted string, enabling encryption in only one company which makes data not usable in another on the same tenant etc.). Use the <a href=/nav/w/designpatterns/277.3-single-point-of-acces><strong>Single Point of Access</strong></a> pattern to handle sensitive data which needs to be encrypted.</li>
<li><strong>System calls and &ldquo;Do It Yourself&rdquo; solutions</strong>: Although system calls for encryptions are available in NAV (ENCRYPT, DECRYPT and &lt;action>ENCRYPTIONKEY), unless there is no other way, refrain from using them directly. Use instead he API in codeunit 1266 Encryption Management, which is safer to use, because it protects against common mistakes (like attempting to encrypt an already encrypted string, enabling encryption in only one company which makes data not usable in another on the same tenant etc.). Use the <a href=/navpatterns/1-patterns/security/3-single-point-of-access/><strong>Single Point of Access</strong></a> pattern to handle sensitive data which needs to be encrypted.</li>
<li><strong>System-level encryption.</strong> The similar codeunit API 1803 Encrypted Key/Value Management is not intended to be reused by partner NAV developers. Normal NAV users do not have permission to access this resource. This stores sensitive data to be accessed by system NAV functionality.</li>
</ul>
<p><strong>References</strong></p>
<p>[1]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation>https://en.wikipedia.org/wiki/Separation</a>_of_concerns.</p>
<p>[2]</p>
<p>&ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary>https://en.wikipedia.org/wiki/Binary</a>_large_object.</p>
<p>[4]</p>
<p>waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5]</p>
<p>Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6]</p>
<p>B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7]</p>
<p>&ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun>https://en.wikipedia.org/wiki/Shotgun</a>_surgery. [Accessed 31 07 2016].</p>
<p>[8]</p>
<p>M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9]</p>
<p>&ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data>https://en.wikipedia.org/wiki/Data</a>_masking#Masking_out. [Accessed 29 7 2016].</p>
<p>[10]</p>
<p>&ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11]</p>
<p>&ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12]</p>
<p>&ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef</a>_sniffer.htm. [Accessed 02 08 2016].</p>
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation_of_concerns>https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary_large_object>https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun_surgery>https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data_masking#Masking_out>https://en.wikipedia.org/wiki/Data_masking#Masking_out</a>. [Accessed 29 7 2016].</p>
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p>
<footer class=footline>
</footer>
</main>
@ -380,12 +393,12 @@ _</p>
<div style=left:-1000px;overflow:scroll;position:absolute;top:-1000px;border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px>
<div style=border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px></div>
</div>
<script src=/js/clipboard.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644506469></script>
<script src=/js/jquery.svg.pan.zoom.js?1644506469></script>
<script src=/js/featherlight.min.js?1644506469></script>
<script src=/js/modernizr.custom-3.6.0.js?1644506469></script>
<script src=/js/relearn.js?1644506469></script>
<script src=/js/clipboard.min.js?1644600600></script>
<script src=/js/perfect-scrollbar.min.js?1644600600></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644600600></script>
<script src=/js/jquery.svg.pan.zoom.js?1644600600></script>
<script src=/js/featherlight.min.js?1644600600></script>
<script src=/js/modernizr.custom-3.6.0.js?1644600600></script>
<script src=/js/relearn.js?1644600600></script>
</body>
</html>

85
navpatterns/1-patterns/security/3-single-point-of-access/index.html
View file

@ -5,16 +5,16 @@
<meta name=generator content="Hugo 0.92.1">
<meta name=description content>
<title>Single Point of Access :: AL Guidelines</title>
<link href=/css/nucleus.css?1644506469 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644506469 rel=stylesheet>
<link href=/css/featherlight.min.css?1644506469 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644506469 rel=stylesheet>
<link href=/css/auto-complete.css?1644506469 rel=stylesheet>
<link href=/css/theme.css?1644506469 rel=stylesheet>
<link href=/css/theme-blue.css?1644506469 rel=stylesheet>
<link href=/css/variant.css?1644506469 rel=stylesheet>
<link href=/css/print.css?1644506469 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644506469></script>
<link href=/css/nucleus.css?1644600600 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644600600 rel=stylesheet>
<link href=/css/featherlight.min.css?1644600600 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644600600 rel=stylesheet>
<link href=/css/auto-complete.css?1644600600 rel=stylesheet>
<link href=/css/theme.css?1644600600 rel=stylesheet>
<link href=/css/theme-blue.css?1644600600 rel=stylesheet>
<link href=/css/variant.css?1644600600 rel=stylesheet>
<link href=/css/print.css?1644600600 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644600600></script>
<style>:root #header+#content>#left>#rlblock_left{display:none!important}</style>
</head>
<body data-url=/navpatterns/1-patterns/security/3-single-point-of-access/>
@ -32,9 +32,9 @@ ALGuidelines.Dev
<input data-search-input id=search-by type=search placeholder=Search...>
<span data-search-clear><i class="fas fa-times"></i></span>
</div>
<script src=/js/lunr.min.js?1644506469></script>
<script src=/js/auto-complete.js?1644506469></script>
<script src=/js/search.js?1644506469></script>
<script src=/js/lunr.min.js?1644600600></script>
<script src=/js/auto-complete.js?1644600600></script>
<script src=/js/search.js?1644600600></script>
</div>
<div class=highlightable>
<ul class=topics>
@ -256,12 +256,9 @@ ALGuidelines.Dev
<main id=body-inner>
<h1>Single Point of Access</h1>
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
<p>_<a href=Logo-_2D00_-Single-Point-of-Access.png><img src=Logo-_2D00_-Single-Point-of-Access.png alt=" "></a><br>
_</p>
<p>__</p>
<p><a href=Logo-_2D00_-Single-Point-of-Access.png><img src=Logo-_2D00_-Single-Point-of-Access.png alt=" "></a></p>
<p><strong>Context</strong>: Protected data needs to be used. There are many types of entities which might attempt to use the data.</p>
<p><strong>Problem</strong>: If no standard way of accessing data exists, then each entity might attempt to build its own system for handing the sensitive data. The data access layer might be implemented over and over again by each entity, without reuse of known best practices and with a lot of code duplication.</p>
<hr>
<p><strong>Forces:</strong></p>
<ul>
<li><strong>Code duplication:</strong> if each entity attempts to write its own routines for data access, invariably this will bring duplication.</li>
@ -273,8 +270,8 @@ _</p>
</ul>
</li>
</ul>
<p><strong>Solution:</strong> In Dynamics NAV the same library which offers <a href=/nav/w/designpatterns/276.2-data-encryption><strong>Encryption</strong></a>, is also intended to be used as a <strong>Single Point of Access</strong>. Write code to create, read and remove sensitive data only through codeunit 1266 Encryption Management, and never directly.</p>
<p>In Figure 9 (figure numbering is continued from pattern <strong><a href=/nav/w/designpatterns/276.encryption>Encryption</a></strong>), the panels 1, 2 and 3 have applied the <a href=/nav/w/designpatterns/275.1-sensitive-data-encapsulation><strong>Sensitive Data Encapsulation</strong></a> and <a href=/nav/w/designpatterns/276.2-data-encryption><strong>Encryption</strong> </a>patterns. Once data is encapsulated, no matter if it has been encrypted or not, the next pattern, <strong>Single Point of Access</strong>, becomes available as seen in the panels 2 and 3 of Figure 1.</p>
<p><strong>Solution:</strong> In Dynamics NAV the same library which offers <a href=/navpatterns/1-patterns/security/2-data-encryption/><strong>Encryption</strong></a>, is also intended to be used as a <strong>Single Point of Access</strong>. Write code to create, read and remove sensitive data only through codeunit 1266 Encryption Management, and never directly.</p>
<p>In Figure 9 (figure numbering is continued from pattern <strong><a href=/navpatterns/1-patterns/security/2-data-encryption/>Encryption</a></strong>), the panels 1, 2 and 3 have applied the <a href=/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/><strong>Sensitive Data Encapsulation</strong></a> and <a href=/navpatterns/1-patterns/security/2-data-encryption/><strong>Encryption</strong></a> patterns. Once data is encapsulated, no matter if it has been encrypted or not, the next pattern, <strong>Single Point of Access</strong>, becomes available as seen in the panels 2 and 3 of Figure 1.</p>
<p>You can observe that, in panel 3, each usage needs to access separately the encrypted data. This means that each usage needs to implement again the encryption capabilities. This is resolved in panel 4, where all users access one common API which encrypts, hence the workload of encryption is moved from the usages, to the API, and needs to be implemented only once.</p>
<p><a href=Multi-_2D00_-1-2-3-4.JPG><img src=Multi-_2D00_-1-2-3-4.JPG alt=" "></a></p>
<p><em>Figure 1- <strong>Single Point of Access</strong> pattern applied.</em></p>
@ -296,30 +293,18 @@ _</p>
<li><strong>Single point of failure:</strong> A defect in the access library will affect all usages until it is found and fixed.</li>
</ul>
<p><strong>References</strong></p>
<p>[1]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation>https://en.wikipedia.org/wiki/Separation</a>_of_concerns.</p>
<p>[2]</p>
<p>&ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary>https://en.wikipedia.org/wiki/Binary</a>_large_object.</p>
<p>[4]</p>
<p>waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5]</p>
<p>Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6]</p>
<p>B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7]</p>
<p>&ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun>https://en.wikipedia.org/wiki/Shotgun</a>_surgery. [Accessed 31 07 2016].</p>
<p>[8]</p>
<p>M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9]</p>
<p>&ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data>https://en.wikipedia.org/wiki/Data</a>_masking#Masking_out. [Accessed 29 7 2016].</p>
<p>[10]</p>
<p>&ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11]</p>
<p>&ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12]</p>
<p>&ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef</a>_sniffer.htm. [Accessed 02 08 2016].</p>
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation_of_concerns>https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary_large_object>https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun_surgery>https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data_masking#Masking_out>https://en.wikipedia.org/wiki/Data_masking#Masking_out</a>. [Accessed 29 7 2016].</p>
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p>
<footer class=footline>
</footer>
</main>
@ -332,12 +317,12 @@ _</p>
<div style=left:-1000px;overflow:scroll;position:absolute;top:-1000px;border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px>
<div style=border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px></div>
</div>
<script src=/js/clipboard.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644506469></script>
<script src=/js/jquery.svg.pan.zoom.js?1644506469></script>
<script src=/js/featherlight.min.js?1644506469></script>
<script src=/js/modernizr.custom-3.6.0.js?1644506469></script>
<script src=/js/relearn.js?1644506469></script>
<script src=/js/clipboard.min.js?1644600600></script>
<script src=/js/perfect-scrollbar.min.js?1644600600></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644600600></script>
<script src=/js/jquery.svg.pan.zoom.js?1644600600></script>
<script src=/js/featherlight.min.js?1644600600></script>
<script src=/js/modernizr.custom-3.6.0.js?1644600600></script>
<script src=/js/relearn.js?1644600600></script>
</body>
</html>

89
navpatterns/1-patterns/security/4-masked-text/index.html
View file

@ -5,16 +5,16 @@
<meta name=generator content="Hugo 0.92.1">
<meta name=description content>
<title>Masked Text :: AL Guidelines</title>
<link href=/css/nucleus.css?1644506469 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644506469 rel=stylesheet>
<link href=/css/featherlight.min.css?1644506469 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644506469 rel=stylesheet>
<link href=/css/auto-complete.css?1644506469 rel=stylesheet>
<link href=/css/theme.css?1644506469 rel=stylesheet>
<link href=/css/theme-blue.css?1644506469 rel=stylesheet>
<link href=/css/variant.css?1644506469 rel=stylesheet>
<link href=/css/print.css?1644506469 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644506469></script>
<link href=/css/nucleus.css?1644600600 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644600600 rel=stylesheet>
<link href=/css/featherlight.min.css?1644600600 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644600600 rel=stylesheet>
<link href=/css/auto-complete.css?1644600600 rel=stylesheet>
<link href=/css/theme.css?1644600600 rel=stylesheet>
<link href=/css/theme-blue.css?1644600600 rel=stylesheet>
<link href=/css/variant.css?1644600600 rel=stylesheet>
<link href=/css/print.css?1644600600 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644600600></script>
<style>:root #header+#content>#left>#rlblock_left{display:none!important}</style>
</head>
<body data-url=/navpatterns/1-patterns/security/4-masked-text/>
@ -32,9 +32,9 @@ ALGuidelines.Dev
<input data-search-input id=search-by type=search placeholder=Search...>
<span data-search-clear><i class="fas fa-times"></i></span>
</div>
<script src=/js/lunr.min.js?1644506469></script>
<script src=/js/auto-complete.js?1644506469></script>
<script src=/js/search.js?1644506469></script>
<script src=/js/lunr.min.js?1644600600></script>
<script src=/js/auto-complete.js?1644600600></script>
<script src=/js/search.js?1644600600></script>
</div>
<div class=highlightable>
<ul class=topics>
@ -256,13 +256,10 @@ ALGuidelines.Dev
<main id=body-inner>
<h1>Masked Text</h1>
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
<p>_<a href=Logo-_2D00_-Masked-Text.png><img src=Logo-_2D00_-Masked-Text.png alt=" "></a><br>
_</p>
<p>__</p>
<p><a href=Logo-_2D00_-Masked-Text.png><img src=Logo-_2D00_-Masked-Text.png alt=" "></a></p>
<p><strong>Aliases:</strong> Masking out</p>
<p><strong>Context</strong>: In the user interface (UI) of a software system, the user enters protected information such as a password, an access key, a credit card number etc.</p>
<p><strong>Problem</strong>: The entered information is visible during data entry and whenever any user (the one who entered the data, or a foreign user) opens the UI.</p>
<hr>
<p><strong>Forces:</strong></p>
<ul>
<li><strong>Information disclosure:</strong> sensitive data is visible in the UI.</li>
@ -272,9 +269,13 @@ _</p>
<p><a href=Masking-_2D00_-CRM-Connection-Setup-page.PNG><img src=Masking-_2D00_-CRM-Connection-Setup-page.PNG alt=" "></a></p>
<p><em>Figure 1 - The field &ldquo;Password&rdquo; is masked.</em></p>
<p>To apply this pattern in Dynamics NAV, the developer has two choices:</p>
<p><strong>1.</strong> <strong>Mask everywhere</strong></p>
<ol>
<li><strong>Mask everywhere</strong></li>
</ol>
<p>Mask the field in all pages which expose it or will expose it in the future. In this case, masking needs to be set at the table level, by opening the table in design mode and setting the field&rsquo;s property ExtendedDatatype=Masked.</p>
<p><strong>2.</strong> <strong>Mask only in selected pages</strong></p>
<ol start=2>
<li><strong>Mask only in selected pages</strong></li>
</ol>
<p>Mask the field in only a subset of pages. Open the pages where the field should be masked in design mode, open the property page for the field in question, and set ExtendedDatatype=Masked. This option can be used for example when a field should be hidden from most users (in most usual pages), but still visible to administrators in specific pages.</p>
<p><strong>Benefits:</strong></p>
<ul>
@ -285,30 +286,18 @@ _</p>
<li><strong>&ldquo;Forgotten password&rdquo;:</strong> the text in a masked field is hidden from all users, including users who theoretically have the right to see it. In this case, if the developer wishes to disclose the text only to certain users, they have to write extra code (like a lookup trigger) which will verify the user&rsquo;s permissions and if permitted, show or send the clear-text value to the user who requested it.</li>
</ul>
<p><strong>References</strong></p>
<p>[1]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation>https://en.wikipedia.org/wiki/Separation</a>_of_concerns.</p>
<p>[2]</p>
<p>&ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary>https://en.wikipedia.org/wiki/Binary</a>_large_object.</p>
<p>[4]</p>
<p>waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5]</p>
<p>Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6]</p>
<p>B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7]</p>
<p>&ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun>https://en.wikipedia.org/wiki/Shotgun</a>_surgery. [Accessed 31 07 2016].</p>
<p>[8]</p>
<p>M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9]</p>
<p>&ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data>https://en.wikipedia.org/wiki/Data</a>_masking#Masking_out. [Accessed 29 7 2016].</p>
<p>[10]</p>
<p>&ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11]</p>
<p>&ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12]</p>
<p>&ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef</a>_sniffer.htm. [Accessed 02 08 2016].</p>
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation_of_concerns>https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary_large_object>https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun_surgery>https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data_masking>https://en.wikipedia.org/wiki/Data_masking</a>#Masking_out. [Accessed 29 7 2016].</p>
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p>
<footer class=footline>
</footer>
</main>
@ -321,12 +310,12 @@ _</p>
<div style=left:-1000px;overflow:scroll;position:absolute;top:-1000px;border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px>
<div style=border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px></div>
</div>
<script src=/js/clipboard.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644506469></script>
<script src=/js/jquery.svg.pan.zoom.js?1644506469></script>
<script src=/js/featherlight.min.js?1644506469></script>
<script src=/js/modernizr.custom-3.6.0.js?1644506469></script>
<script src=/js/relearn.js?1644506469></script>
<script src=/js/clipboard.min.js?1644600600></script>
<script src=/js/perfect-scrollbar.min.js?1644600600></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644600600></script>
<script src=/js/jquery.svg.pan.zoom.js?1644600600></script>
<script src=/js/featherlight.min.js?1644600600></script>
<script src=/js/modernizr.custom-3.6.0.js?1644600600></script>
<script src=/js/relearn.js?1644600600></script>
</body>
</html>

82
navpatterns/1-patterns/security/5-ssl-in-nav/index.html
View file

@ -5,16 +5,16 @@
<meta name=generator content="Hugo 0.92.1">
<meta name=description content>
<title>SSL in NAV :: AL Guidelines</title>
<link href=/css/nucleus.css?1644506469 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644506469 rel=stylesheet>
<link href=/css/featherlight.min.css?1644506469 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644506469 rel=stylesheet>
<link href=/css/auto-complete.css?1644506469 rel=stylesheet>
<link href=/css/theme.css?1644506469 rel=stylesheet>
<link href=/css/theme-blue.css?1644506469 rel=stylesheet>
<link href=/css/variant.css?1644506469 rel=stylesheet>
<link href=/css/print.css?1644506469 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644506469></script>
<link href=/css/nucleus.css?1644600600 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644600600 rel=stylesheet>
<link href=/css/featherlight.min.css?1644600600 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644600600 rel=stylesheet>
<link href=/css/auto-complete.css?1644600600 rel=stylesheet>
<link href=/css/theme.css?1644600600 rel=stylesheet>
<link href=/css/theme-blue.css?1644600600 rel=stylesheet>
<link href=/css/variant.css?1644600600 rel=stylesheet>
<link href=/css/print.css?1644600600 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644600600></script>
<style>:root #header+#content>#left>#rlblock_left{display:none!important}</style>
</head>
<body data-url=/navpatterns/1-patterns/security/5-ssl-in-nav/>
@ -32,9 +32,9 @@ ALGuidelines.Dev
<input data-search-input id=search-by type=search placeholder=Search...>
<span data-search-clear><i class="fas fa-times"></i></span>
</div>
<script src=/js/lunr.min.js?1644506469></script>
<script src=/js/auto-complete.js?1644506469></script>
<script src=/js/search.js?1644506469></script>
<script src=/js/lunr.min.js?1644600600></script>
<script src=/js/auto-complete.js?1644600600></script>
<script src=/js/search.js?1644600600></script>
</div>
<div class=highlightable>
<ul class=topics>
@ -256,9 +256,7 @@ ALGuidelines.Dev
<main id=body-inner>
<h1>SSL in NAV</h1>
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
<p>_<a href=Logo-_2D00_-SSL.JPG><img src=Logo-_2D00_-SSL.JPG alt=" "></a><br>
_</p>
<p>__</p>
<p><a href=Logo-_2D00_-SSL.JPG><img src=Logo-_2D00_-SSL.JPG alt=" "></a></p>
<p><strong>Context</strong>: The security of data transmission is just as important as the security of data storage. When data is transmitted over the web, Secure Sockets Layer (SSL) is available to be used with the web client in Dynamics NAV. Microsoft&rsquo;s NAV cloud solution has SSL enabled by default. However, if a partner company chooses to deploy their own NAV, then they need to handle SSL explicitly.</p>
<p><strong>Problem</strong>: Although data is stored securely, before it even gets to be stored, it needs to travel the web on a client-server connection, where it is vulnerable.</p>
<p><strong>Forces:</strong></p>
@ -269,7 +267,7 @@ _</p>
<p><strong>Solution:</strong> To protect the data before it reaches the server, remember to configure SSL (Secure Sockets Layer) in Dynamics NAV.</p>
<p><em>SSL</em> is a web protocol that encrypts data that is transmitted over a network to make the data and the network more secure and reliable. A website that is enabled with SSL uses Hypertext Transfer Protocol Secure (HTTPS) instead of Hypertext Transfer Protocol (HTTP) as a communication protocol.</p>
<p>Figure 1 shows data communication between the client (where the user enters data) and the server (which connects further to the database). Without encryption (left side), data is available in clear text over the wire. A person equipped with a network sniffer can easily intercept and read it. On the right side of the picture, SSL is used to encrypt the user&rsquo;s data. Sniffing the traffic would capture the encrypted stream, but access to the real content would be impeded by encryption.</p>
<p>**<a href=SSL-_2D00_-before-and-after.PNG><img src=SSL-_2D00_-before-and-after.PNG alt=" "></a>**</p>
<p><a href=SSL-_2D00_-before-and-after.PNG><img src=SSL-_2D00_-before-and-after.PNG alt=" "></a></p>
<p><em>Figure 1 - Data transmission before (http://&mldr;) and after SSL encryption (https://&mldr;).</em></p>
<p><strong>Usage</strong>: the latest information about how to configure SSL for the web client in Dynamics NAV is found online at on MSDN at <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>.</p>
<p><strong>Benefits:</strong></p>
@ -282,30 +280,18 @@ _</p>
<li><strong>Extra work:</strong> there is extra effort to enable SSL on a self-administered NAV system. The good news is that Microsoft&rsquo;s cloud NAV solution has SSL by default and no extra work is required from the developer on that aspect.</li>
</ul>
<p><strong>References</strong></p>
<p>[1]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation>https://en.wikipedia.org/wiki/Separation</a>_of_concerns.</p>
<p>[2]</p>
<p>&ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3]</p>
<p>&ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary>https://en.wikipedia.org/wiki/Binary</a>_large_object.</p>
<p>[4]</p>
<p>waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5]</p>
<p>Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6]</p>
<p>B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7]</p>
<p>&ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun>https://en.wikipedia.org/wiki/Shotgun</a>_surgery. [Accessed 31 07 2016].</p>
<p>[8]</p>
<p>M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9]</p>
<p>&ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data>https://en.wikipedia.org/wiki/Data</a>_masking#Masking_out. [Accessed 29 7 2016].</p>
<p>[10]</p>
<p>&ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11]</p>
<p>&ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12]</p>
<p>&ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef</a>_sniffer.htm. [Accessed 02 08 2016].</p>
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Separation_of_concerns>https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href=https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx>https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Binary_large_object>https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href=https://community.dynamics.com/nav/w/designpatterns/76.setup-table>https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Shotgun_surgery>https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href=https://en.wikipedia.org/wiki/Data_masking#Masking_out>https://en.wikipedia.org/wiki/Data_masking#Masking_out</a>. [Accessed 29 7 2016].</p>
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href=https://azure.microsoft.com/en-us/services/key-vault/>https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href=http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm>http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p>
<footer class=footline>
</footer>
</main>
@ -318,12 +304,12 @@ _</p>
<div style=left:-1000px;overflow:scroll;position:absolute;top:-1000px;border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px>
<div style=border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px></div>
</div>
<script src=/js/clipboard.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.min.js?1644506469></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644506469></script>
<script src=/js/jquery.svg.pan.zoom.js?1644506469></script>
<script src=/js/featherlight.min.js?1644506469></script>
<script src=/js/modernizr.custom-3.6.0.js?1644506469></script>
<script src=/js/relearn.js?1644506469></script>
<script src=/js/clipboard.min.js?1644600600></script>
<script src=/js/perfect-scrollbar.min.js?1644600600></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644600600></script>
<script src=/js/jquery.svg.pan.zoom.js?1644600600></script>
<script src=/js/featherlight.min.js?1644600600></script>
<script src=/js/modernizr.custom-3.6.0.js?1644600600></script>
<script src=/js/relearn.js?1644600600></script>
</body>
</html>

50
navpatterns/1-patterns/security/index.html
View file

@ -6,16 +6,16 @@
<link rel=alternate type=application/rss+xml href=/navpatterns/1-patterns/security/index.xml title="AL Guidelines">
<meta name=description content>
<title>Security :: AL Guidelines</title>
<link href=/css/nucleus.css?1644506471 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644506471 rel=stylesheet>
<link href=/css/featherlight.min.css?1644506471 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644506471 rel=stylesheet>
<link href=/css/auto-complete.css?1644506471 rel=stylesheet>
<link href=/css/theme.css?1644506471 rel=stylesheet>
<link href=/css/theme-blue.css?1644506471 rel=stylesheet>
<link href=/css/variant.css?1644506471 rel=stylesheet>
<link href=/css/print.css?1644506471 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644506471></script>
<link href=/css/nucleus.css?1644600601 rel=stylesheet>
<link href=/css/fontawesome-all.min.css?1644600601 rel=stylesheet>
<link href=/css/featherlight.min.css?1644600601 rel=stylesheet>
<link href=/css/perfect-scrollbar.min.css?1644600601 rel=stylesheet>
<link href=/css/auto-complete.css?1644600601 rel=stylesheet>
<link href=/css/theme.css?1644600601 rel=stylesheet>
<link href=/css/theme-blue.css?1644600601 rel=stylesheet>
<link href=/css/variant.css?1644600601 rel=stylesheet>
<link href=/css/print.css?1644600601 rel=stylesheet media=print>
<script src=/js/jquery.min.js?1644600601></script>
<style>:root #header+#content>#left>#rlblock_left{display:none!important}</style>
</head>
<body data-url=/navpatterns/1-patterns/security/>
@ -33,9 +33,9 @@ ALGuidelines.Dev
<input data-search-input id=search-by type=search placeholder=Search...>
<span data-search-clear><i class="fas fa-times"></i></span>
</div>
<script src=/js/lunr.min.js?1644506471></script>
<script src=/js/auto-complete.js?1644506471></script>
<script src=/js/search.js?1644506471></script>
<script src=/js/lunr.min.js?1644600601></script>
<script src=/js/auto-complete.js?1644600601></script>
<script src=/js/search.js?1644600601></script>
</div>
<div class=highlightable>
<ul class=topics>
@ -269,11 +269,11 @@ ALGuidelines.Dev
<p>When sensitive data is stored inside the Dynamics NAV database, if negligently handled, it can become vulnerable. Particularly, the location, access and the state of the data are critical.</p>
<p>Use the following patterns to enhance security on your NAV system.</p>
<ol>
<li><a href=/nav/w/designpatterns/275.sensitive-data-encapsulation>Sensitive Data Encapsulation</a></li>
<li><a href=/nav/w/designpatterns/276.encryption>Data Encryption</a></li>
<li><a href=/nav/w/designpatterns/277.single-point-of-access>Single Point of Access</a></li>
<li><a href=/nav/w/designpatterns/278.masked-text>Masked Text</a></li>
<li><a href=/nav/w/designpatterns/279.ssl-in-nav>SSL in NAV</a></li>
<li><a href=/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/>Sensitive Data Encapsulation</a></li>
<li><a href=/navpatterns/1-patterns/security/2-data-encryption/>Data Encryption</a></li>
<li><a href=/navpatterns/1-patterns/security/3-single-point-of-access/>Single Point of Access</a></li>
<li><a href=/navpatterns/1-patterns/security/4-masked-text/>Masked Text</a></li>
<li><a href=/navpatterns/1-patterns/security/5-ssl-in-nav/>SSL in NAV</a></li>
</ol>
<footer class=footline>
</footer>
@ -287,12 +287,12 @@ ALGuidelines.Dev
<div style=left:-1000px;overflow:scroll;position:absolute;top:-1000px;border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px>
<div style=border:none;box-sizing:content-box;height:200px;margin:0;padding:0;width:200px></div>
</div>
<script src=/js/clipboard.min.js?1644506471></script>
<script src=/js/perfect-scrollbar.min.js?1644506471></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644506471></script>
<script src=/js/jquery.svg.pan.zoom.js?1644506471></script>
<script src=/js/featherlight.min.js?1644506471></script>
<script src=/js/modernizr.custom-3.6.0.js?1644506471></script>
<script src=/js/relearn.js?1644506471></script>
<script src=/js/clipboard.min.js?1644600601></script>
<script src=/js/perfect-scrollbar.min.js?1644600601></script>
<script src=/js/perfect-scrollbar.jquery.min.js?1644600601></script>
<script src=/js/jquery.svg.pan.zoom.js?1644600601></script>
<script src=/js/featherlight.min.js?1644600601></script>
<script src=/js/modernizr.custom-3.6.0.js?1644600601></script>
<script src=/js/relearn.js?1644600601></script>
</body>
</html>

20
navpatterns/1-patterns/security/index.xml
View file

@ -1,36 +1,16 @@
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Security on AL Guidelines</title><link>https://alguidelines.dev/navpatterns/1-patterns/security/</link><description>Recent content in Security on AL Guidelines</description><generator>Hugo -- gohugo.io</generator><language>en-us</language><atom:link href="https://alguidelines.dev/navpatterns/1-patterns/security/index.xml" rel="self" type="application/rss+xml"/><item><title>Sensitive Data Encapsulation</title><link>https://alguidelines.dev/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/</guid><description>By Bogdana Botez at Microsoft Development Center Copenhagen
_
_
**
**
Aliases: Encapsulation, Separation of Concerns [1]
**
**
Context: You want to store and protect sensitive data which already exists in a system, but it is not clear which data needs protection and how to store it.
Problem: Sensitive data is scattered and mixed with other data in various parts of the system (passwords residing in the same table with non-sensitive data, part of the private information might be stored in files, hardcoded text constants, hardcoded info as part of the code etc.</description></item><item><title>Data Encryption</title><link>https://alguidelines.dev/navpatterns/1-patterns/security/2-data-encryption/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/navpatterns/1-patterns/security/2-data-encryption/</guid><description>By Bogdana Botez at Microsoft Development Center Copenhagen
__
_
_
Context: After applying Sensitive Data Encapsulation, all sensitive data is gathered in a known place in the database. This makes it possible to apply further protection best practices.
Problem: If any non-authorized actor manages to get access to a copy of the database, the sensitive data is immediately available in clear-text.
**
**
Forces:
Accessibility: anyone who managed to steal a copy of the database can at once read the sensitive information.</description></item><item><title>Single Point of Access</title><link>https://alguidelines.dev/navpatterns/1-patterns/security/3-single-point-of-access/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/navpatterns/1-patterns/security/3-single-point-of-access/</guid><description>By Bogdana Botez at Microsoft Development Center Copenhagen
_
_
__
Context: Protected data needs to be used. There are many types of entities which might attempt to use the data.
Problem: If no standard way of accessing data exists, then each entity might attempt to build its own system for handing the sensitive data. The data access layer might be implemented over and over again by each entity, without reuse of known best practices and with a lot of code duplication.</description></item><item><title>Masked Text</title><link>https://alguidelines.dev/navpatterns/1-patterns/security/4-masked-text/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/navpatterns/1-patterns/security/4-masked-text/</guid><description>By Bogdana Botez at Microsoft Development Center Copenhagen
_
_
__
Aliases: Masking out
Context: In the user interface (UI) of a software system, the user enters protected information such as a password, an access key, a credit card number etc.
Problem: The entered information is visible during data entry and whenever any user (the one who entered the data, or a foreign user) opens the UI.
Forces:
Information disclosure: sensitive data is visible in the UI.</description></item><item><title>SSL in NAV</title><link>https://alguidelines.dev/navpatterns/1-patterns/security/5-ssl-in-nav/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/navpatterns/1-patterns/security/5-ssl-in-nav/</guid><description>By Bogdana Botez at Microsoft Development Center Copenhagen
_
_
__
Context: The security of data transmission is just as important as the security of data storage. When data is transmitted over the web, Secure Sockets Layer (SSL) is available to be used with the web client in Dynamics NAV. Microsoft&amp;rsquo;s NAV cloud solution has SSL enabled by default. However, if a partner company chooses to deploy their own NAV, then they need to handle SSL explicitly.</description></item></channel></rss>