323 lines
No EOL
49 KiB
XML
323 lines
No EOL
49 KiB
XML
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>alguidelines.dev - Business Central Design Patterns – Security</title><link>https://alguidelines.dev/docs/navpatterns/patterns/security/</link><description>Recent content in Security on alguidelines.dev - Business Central Design Patterns</description><generator>Hugo -- gohugo.io</generator><language>en-us</language><atom:link href="https://alguidelines.dev/docs/navpatterns/patterns/security/index.xml" rel="self" type="application/rss+xml"/><item><title>Docs: Sensitive Data Encapsulation</title><link>https://alguidelines.dev/docs/navpatterns/patterns/security/1-sensitive-data-encapsulation/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/docs/navpatterns/patterns/security/1-sensitive-data-encapsulation/</guid><description>
|
||
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
|
||
<p><a href="Logo-_2D00_-Protected-Data-Encapsulation.png"><img src="Logo-_2D00_-Protected-Data-Encapsulation.png" alt=" "></a></p>
|
||
<p><strong>Aliases:</strong> Encapsulation, Separation of Concerns [1]</p>
|
||
<p><strong>Context</strong>: You want to store and protect sensitive data which already exists in a system, but it is not clear which data needs protection and how to store it.</p>
|
||
<p><strong>Problem</strong>: Sensitive data is scattered and mixed with other data in various parts of the system (passwords residing in the same table with non-sensitive data, part of the private information might be stored in files, hardcoded text constants, hardcoded info as part of the code etc.).</p>
|
||
<p><strong>Forces:</strong></p>
|
||
<ul>
|
||
<li><strong>Obscurity:</strong> sensitive data mixed with other data and code makes it hard to have an overview of what needs to be protected.</li>
|
||
<li><strong>Effort:</strong> the protection mechanisms needs to be applied multiple times, once for each location of the sensitive data.</li>
|
||
<li><strong>Diversity:</strong> different data storage mediums can require different protection solutions.</li>
|
||
<li><strong>Cohesiveness:</strong> code, low importance data, highly sensitive data are all monolithically mixed which might make it hard to select and protect only what is important.</li>
|
||
<li><strong>Low</strong> <strong>Performance</strong>: protecting all data can slow down the system.</li>
|
||
</ul>
|
||
<p><strong>Solution:</strong> Extract and separate sensitive data into a single known repository.</p>
|
||
<p>To apply this pattern in Dynamics NAV, a table structure similar to Table 1261 Service Password can be used. The Service Password table also contains additional functionality which will help to further apply related patterns like <a href="https://alguidelines.dev/navpatterns/1-patterns/security/3-single-point-of-access/"><strong>Access Control</strong></a> and <a href="https://alguidelines.dev/navpatterns/1-patterns/security/2-data-encryption/"><strong>Encryption</strong></a>.</p>
|
||
<p>Figure 1 describes the definition of a table which is already available in Dynamics NAV. This table can be used for storing sensitive data. As a minimum, the table only needs two fields:</p>
|
||
<ol>
|
||
<li>The key is of type GUID (Globally Unique Identifier), which is a 128-bit value consisting of multiple groups of hexadecimal digits [2]. Each key needs to be unique and will be used for storing and retrieving the protected information.</li>
|
||
<li>The value (the actual data to be encapsulated) is of type BLOB (Binary Large OBject) [3], which contains the encrypted or un-encrypted data (for encryption, see the related <a href="https://alguidelines.dev/navpatterns/1-patterns/security/2-data-encryption/"><strong>Encryption</strong></a> pattern).</li>
|
||
</ol>
|
||
<p><a href="Data-Encapsulation-_2D00_-figure-1.png"><img src="Data-Encapsulation-_2D00_-figure-1.png" alt="Figure 1- Example definition, table used for Data Encapsulation"></a></p>
|
||
<p><em>Figure 1- Example definition, table used for <strong>Sensitive</strong> <strong>Data</strong> <strong>Encapsulation</strong></em></p>
|
||
<p>Let&rsquo;s use a software system (which can be a Dynamics NAV extension or customization). Chances are that the system will look similar to the one described in part 1 of Figure 2: there is data handled in various places of the system, on various storage solutions. Intertwined with normal data, there is sensitive data. For example: Dynamics CRM (Customer Relationship Management) connection information could be all stored in one table, and consists of the connection URI (normal data), enabled/disabled status (normal data), and connection password (sensitive data).</p>
|
||
<p>Figure 2 illustrates the system before and after applying the <strong>Sensitive Data Encapsulation</strong> pattern.</p>
|
||
<ul>
|
||
<li>Before: picture part 1 shows the initial system, where most likely the data is scattered across the system. Furthermore, it is stored in different mediums, like
|
||
<ul>
|
||
<li>In a table (possible together with low-importance data)</li>
|
||
<li>Hardcoded (in Dynamics NAV, it can be a text constant, or just plainly typed in the code)</li>
|
||
<li>In files</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
<p>Furthermore, actors which have to interact with the data, need to remember where to find each piece of information and how to retrieve it.</p>
|
||
<ul>
|
||
<li>After: the part 2 of Figure 2 shows the same system after application of <strong>Sensitive Data Encapsulation</strong>. Now, all data is stored in one place, and all actors which interact with it can read it from the unique location.</li>
|
||
</ul>
|
||
<p><a href="Multi-_2D00_-1-2.JPG"><img src="Multi-_2D00_-1-2.JPG" alt=" "></a></p>
|
||
<p><em>Figure 2 - Data access before and after <strong>Sensitive</strong> <strong>Data</strong> <strong>Encapsulation.</strong></em></p>
|
||
<p><strong>Benefits:</strong></p>
|
||
<ul>
|
||
<li><strong>Clarity:</strong> when all sensitive data is encapsulated in one place, it is clear which is the information that needs to be protected.</li>
|
||
<li><strong>Simplicity:</strong> easier to protect just a limited number of known resources when they are grouped.</li>
|
||
<li><strong>Homogeneity:</strong> the same protection can be applied to all data, since it is stored in the same place.</li>
|
||
<li><strong>Separation of concerns:</strong> treat each section of the computer program differently, by separating it and clearly addressing its own requirements and limitations. [1]</li>
|
||
<li><strong>Performance</strong>: data protection techniques like <strong>Access Control</strong> and <strong>Encryption</strong> can now be applied only to the sensitive data (not to everything), which improves the performance of the system.</li>
|
||
</ul>
|
||
<p><strong>Drawbacks:</strong></p>
|
||
<ul>
|
||
<li><strong>Single point of failure:</strong> a maliciously intended actor has no longer a need to reverse engineer the places where important data is stored. In the unwanted situation when this actor would have already obtained access to the system, they can more easily locate the sensitive information. This is a step towards information disclosure, but mechanisms like <a href="https://alguidelines.dev/navpatterns/1-patterns/security/2-data-encryption/"><strong>Encryption</strong></a> and logging can provide further protection.</li>
|
||
<li><strong>Limited Text Length</strong>: there is a limit on how long the encrypted text can be. This limit is imposed by the OS encryption service and it depends on the composition of the text as well as on the system specifics. In NAV, we had implemented the Encrypted Text for text values of max 250 chars, which is enough to cover passwords, person ID numbers, credit card info, but it might turn insufficient in other future scenarios.</li>
|
||
<li><strong>Nomenclature</strong>: the name of the table <strong>Service Password</strong> is too specific, since it started by being used for passwords, but it has the capability and it now contains other sensitive data like API Keys, credit card numbers etc.</li>
|
||
</ul>
|
||
<p><strong>References</strong></p>
|
||
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Separation_of_concerns">https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
|
||
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx">https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
|
||
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Binary_large_object">https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
|
||
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
|
||
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
|
||
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href="https://community.dynamics.com/nav/w/designpatterns/76.setup-table">https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
|
||
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Shotgun_surgery">https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
|
||
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
|
||
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Data_masking#Masking_out">https://en.wikipedia.org/wiki/Data_masking#Masking_out</a>. [Accessed 29 7 2016].</p>
|
||
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href="https://azure.microsoft.com/en-us/services/key-vault/">https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
|
||
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
|
||
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href="http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm">http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p></description></item><item><title>Docs: Data Encryption</title><link>https://alguidelines.dev/docs/navpatterns/patterns/security/2-data-encryption/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/docs/navpatterns/patterns/security/2-data-encryption/</guid><description>
|
||
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
|
||
<p><a href="Logo-_2D00_-Encryption.png"><img src="Logo-_2D00_-Encryption.png" alt=" "></a></p>
|
||
<p><strong>Context</strong>: After applying <a href="https://alguidelines.dev/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/"><strong>Sensitive Data Encapsulation</strong></a>, all sensitive data is gathered in a known place in the database. This makes it possible to apply further protection best practices.</p>
|
||
<p><strong>Problem</strong>: If any non-authorized actor manages to get access to a copy of the database, the sensitive data is immediately available in clear-text.</p>
|
||
<p><strong>Forces:</strong></p>
|
||
<ul>
|
||
<li><strong>Accessibility:</strong> anyone who managed to steal a copy of the database can at once read the sensitive information.</li>
|
||
</ul>
|
||
<p><strong>Solution:</strong> Encrypt sensitive data. Dynamics NAV offers a simple mechanism for data encryption, to be used by NAV developers.</p>
|
||
<p>Figure 1 adds one more step (in continuation of the figure in pattern <strong><a href="https://alguidelines.dev/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/">Sensitive Data Encapsulation</a></strong>), in which the first two panels describe how sensitive data has all been gathered in one known place. This makes the current pattern, <strong>Encryption</strong>, much easier &ndash; since now data needs to be encrypted in only one place. The last panel of Figure 1 shows the system after the next step, <strong>Encryption</strong>, has been implemented. This shows the iterative process of applying patterns and making the code better step by step.</p>
|
||
<p><a href="Multi-_2D00_-1-2-3.JPG"><img src="Multi-_2D00_-1-2-3.JPG" alt=" "></a></p>
|
||
<p><em>Figure 1- <strong>Encryption</strong> becomes easier after first applying <a href="https://alguidelines.dev/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/"><strong>Sensitive Data Encapsulation</strong></a>.</em></p>
|
||
<p><strong>Usage</strong>: in Dynamics NAV, codeunit 1266 Encryption Management offers an API for encryption of data. The available functionality is described in Table 1.</p>
|
||
<p>Table 1- Encryption functionality in Dynamics NAV (found in codeunit 1266 Encryption Management)</p>
|
||
<table>
|
||
<thead>
|
||
<tr>
|
||
<th>Procedure</th>
|
||
<th>Description</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td>EnableEncryption</td>
|
||
<td>Confirms with the user before enabling encryption in all companies of the current database.</td>
|
||
</tr>
|
||
<tr>
|
||
<td>EnableEncryptionSilently</td>
|
||
<td>Enables encryption without UI interaction (to be used for web services).</td>
|
||
</tr>
|
||
<tr>
|
||
<td>DisableEncryption</td>
|
||
<td>Disables encryption. Has a boolean &ldquo;Silent&rdquo; parameter which enables/disables UI interaction.</td>
|
||
</tr>
|
||
<tr>
|
||
<td>Encrypt</td>
|
||
<td>Checks that encryption is possible before encrypting the given text.</td>
|
||
</tr>
|
||
<tr>
|
||
<td>Decrypt</td>
|
||
<td>Checks that encryption is possible before decrypting the given text.</td>
|
||
</tr>
|
||
<tr>
|
||
<td>ExportKey</td>
|
||
<td>If encryption is possible, it shows a confirmation dialog to confirm the export of the encryption key, and proceeds to saving it to a location chosen by the user.</td>
|
||
</tr>
|
||
<tr>
|
||
<td>ImportKey</td>
|
||
<td>Imports the encryption key from a user chosen location.</td>
|
||
</tr>
|
||
<tr>
|
||
<td>ChangeKey</td>
|
||
<td>Changes the encryption key.</td>
|
||
</tr>
|
||
<tr>
|
||
<td>IsEncryptionEnabled</td>
|
||
<td>Returns TRUE is encryption is enabled.</td>
|
||
</tr>
|
||
<tr>
|
||
<td>IsEncryptionPossible</td>
|
||
<td>Check is the correct key is present, which only works if encryption is enabled.</td>
|
||
</tr>
|
||
<tr>
|
||
<td>DeleteEncryptedDataInAllCompanies</td>
|
||
<td>Confirms through UI and if the user agrees, deletes all data stored in the Service Password table for all companies in the current database. At the end, it deletes the encryption key.</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<p><strong>User confirmation of encryption</strong></p>
|
||
<p>Ideally, encryption should be enabled by default.</p>
|
||
<p>However, in some versions of Dynamics NAV, there are places where any user who happens to hit a sensitive field (like a password) is asked if they want to encrypt or not. If user confirmation is needed, then let only the security administrators decide (not any random user).</p>
|
||
<p>To ask the security administrator if they want to enable encryption, plug the code below into the OnValidate trigger of the data field which is to be encrypted. This trigger will then get executed each time there&rsquo;s a change on the password field. For example, if the user is entering a password, then add a call to this procedure to Password &ndash; OnValidate() trigger:</p>
|
||
<div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-al" data-lang="al">EncryptionIsNotActivatedQst@<span style="color:#0000cf;font-weight:bold">1001</span><span style="color:#f8f8f8;text-decoration:underline"> </span><span style="color:#000;font-weight:bold">:</span><span style="color:#f8f8f8;text-decoration:underline"> </span><span style="color:#204a87;font-weight:bold">TextConst</span><span style="color:#f8f8f8;text-decoration:underline"> </span><span style="color:#4e9a06">&#39;ENU=Data encryption is not activated. It is recommended that you encrypt data. \\Do you want to open the Data Encryption Management window?&#39;</span><span style="color:#000;font-weight:bold">;</span><span style="color:#f8f8f8;text-decoration:underline">
|
||
</span><span style="color:#f8f8f8;text-decoration:underline">
|
||
</span><span style="color:#f8f8f8;text-decoration:underline"></span><span style="color:#204a87;font-weight:bold">LOCAL</span><span style="color:#f8f8f8;text-decoration:underline"> </span><span style="color:#204a87;font-weight:bold">PROCEDURE</span><span style="color:#f8f8f8;text-decoration:underline"> </span>CheckEncryption@<span style="color:#0000cf;font-weight:bold">6</span><span style="color:#ce5c00;font-weight:bold">()</span><span style="color:#000;font-weight:bold">;</span><span style="color:#f8f8f8;text-decoration:underline">
|
||
</span><span style="color:#f8f8f8;text-decoration:underline"></span><span style="color:#204a87;font-weight:bold">BEGIN</span><span style="color:#f8f8f8;text-decoration:underline">
|
||
</span><span style="color:#f8f8f8;text-decoration:underline"> </span><span style="color:#204a87;font-weight:bold">IF</span><span style="color:#f8f8f8;text-decoration:underline"> </span><span style="color:#204a87;font-weight:bold">NOT</span><span style="color:#f8f8f8;text-decoration:underline"> </span>ENCRYPTIONENABLED<span style="color:#f8f8f8;text-decoration:underline"> </span><span style="color:#204a87;font-weight:bold">THEN</span><span style="color:#f8f8f8;text-decoration:underline">
|
||
</span><span style="color:#f8f8f8;text-decoration:underline"> </span><span style="color:#204a87;font-weight:bold">IF</span><span style="color:#f8f8f8;text-decoration:underline"> </span>CONFIRM<span style="color:#ce5c00;font-weight:bold">(</span>EncryptionIsNotActivatedQst<span style="color:#ce5c00;font-weight:bold">) </span><span style="color:#204a87;font-weight:bold">THEN</span><span style="color:#f8f8f8;text-decoration:underline">
|
||
</span><span style="color:#f8f8f8;text-decoration:underline"> </span><span style="color:#204a87;font-weight:bold">PAGE</span><span style="color:#ce5c00;font-weight:bold">.</span>RUN<span style="color:#ce5c00;font-weight:bold">(</span><span style="color:#204a87;font-weight:bold">PAGE</span><span style="color:#000;font-weight:bold">::</span>&#34;Data Encryption Management&#34;<span style="color:#ce5c00;font-weight:bold">)</span><span style="color:#000;font-weight:bold">;</span><span style="color:#f8f8f8;text-decoration:underline">
|
||
</span><span style="color:#f8f8f8;text-decoration:underline"></span><span style="color:#204a87;font-weight:bold">END</span><span style="color:#000;font-weight:bold">;</span><span style="color:#f8f8f8;text-decoration:underline">
|
||
</span></code></pre></div><p>The code above will guide the user on encrypting, storing the encryption key and choosing a safe password, as follows. Consider for example that NAV is used by a small business, where Stan is the business owner. Hence, Stan has access to all NAV setup and security decisions. Stan wants to enable a connection between NAV and CRM. In NAV, he opens page CRM Connection Setup and enters the URL, user name and password for CRM (Figure 10). When Stan leaves the password field, if data encryption is not enabled, then he sees the confirmation message in Figure 2.</p>
|
||
<p><a href="Encryption-_2D00_-1.JPG"><img src="Encryption-_2D00_-1.JPG" alt=" "></a></p>
|
||
<p><em>Figure 2- The administrator is advised to enable encryption.</em></p>
|
||
<p>Now Stan becomes aware that there is no encryption and has the opportunity to enable it. If he clicks on &ldquo;Yes&rdquo;, Stan will be taken to the Data Encryption Management page (Figure 3).</p>
|
||
<p><a href="Encryption-_2D00_-2.png"><img src="Encryption-_2D00_-2.png" alt=" "></a></p>
|
||
<p><em>Figure 3- Data Encryption Management page</em></p>
|
||
<p>Stan can now choose &ldquo;Enable Encryption&rdquo; from the ribbon which informs him that an encryption key will be created (Figure 4).</p>
|
||
<p><a href="Encryption-_2D00_-3.png"><img src="Encryption-_2D00_-3.png" alt=" "></a></p>
|
||
<p><em>Figure 4- The administrator is encouraged to save a copy of the encryption key.</em></p>
|
||
<p>Stan has the option to save the encryption key in a safe location. He invokes the action Enable Encryption and is guided forward (Figure 5).</p>
|
||
<p><a href="Encryption-_2D00_-4.png"><img src="Encryption-_2D00_-4.png" alt=" "></a></p>
|
||
<p><em>Figure 5- The encryption key needs to be protected by a password.</em></p>
|
||
<p>Stan chooses a password, which in this implementation requires minimum 8 characters with at least one uppercase character, one lowercase character and one digit. If the chosen password is too weak, Stan is given information on the expected complexity (Figure 6).</p>
|
||
<p><a href="Encryption-_2D00_-5.png"><img src="Encryption-_2D00_-5.png" alt=" "></a></p>
|
||
<p><em>Figure 6- The administrator chooses a strong password.</em></p>
|
||
<p>In the end, Stan chooses a location for the encryption key on disk, in a standard file save dialog. The layout of the file save dialog depends on the display target used (web browser, rich client etc.).</p>
|
||
<p><strong>NAV Usages.</strong> Encryption examples can be found in NAV in the following places:</p>
|
||
<ul>
|
||
<li>Page 1260 Bank Data Conv. Service Setup</li>
|
||
<li>Page 1270 OCR Service Setup</li>
|
||
<li>Page 5330 CRM Connection Setup</li>
|
||
<li>Table 1275 Doc. Exch. Service Setup</li>
|
||
</ul>
|
||
<p><strong>Benefits:</strong></p>
|
||
<ul>
|
||
<li><strong>Protection</strong>: even if the database has been compromised, the sensitive data is encrypted hence not immediately accessible. Combined with best user practices like setting strong passwords, encryption can prove to be a very strong protection mechanism.</li>
|
||
</ul>
|
||
<p><strong>Anti-patterns:</strong></p>
|
||
<ul>
|
||
<li><strong>Performance:</strong> Do not encrypt everything, because it will have a performance impact on the system. Only important information should be encrypted.</li>
|
||
<li><strong>System calls and &ldquo;Do It Yourself&rdquo; solutions</strong>: Although system calls for encryptions are available in NAV (ENCRYPT, DECRYPT and &lt;action&gt;ENCRYPTIONKEY), unless there is no other way, refrain from using them directly. Use instead he API in codeunit 1266 Encryption Management, which is safer to use, because it protects against common mistakes (like attempting to encrypt an already encrypted string, enabling encryption in only one company which makes data not usable in another on the same tenant etc.). Use the <a href="https://alguidelines.dev/navpatterns/1-patterns/security/3-single-point-of-access/"><strong>Single Point of Access</strong></a> pattern to handle sensitive data which needs to be encrypted.</li>
|
||
<li><strong>System-level encryption.</strong> The similar codeunit API 1803 Encrypted Key/Value Management is not intended to be reused by partner NAV developers. Normal NAV users do not have permission to access this resource. This stores sensitive data to be accessed by system NAV functionality.</li>
|
||
</ul>
|
||
<p><strong>References</strong></p>
|
||
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Separation_of_concerns">https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
|
||
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx">https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
|
||
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Binary_large_object">https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
|
||
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
|
||
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
|
||
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href="https://community.dynamics.com/nav/w/designpatterns/76.setup-table">https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
|
||
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Shotgun_surgery">https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
|
||
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
|
||
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Data_masking#Masking_out">https://en.wikipedia.org/wiki/Data_masking#Masking_out</a>. [Accessed 29 7 2016].</p>
|
||
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href="https://azure.microsoft.com/en-us/services/key-vault/">https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
|
||
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
|
||
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href="http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm">http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p></description></item><item><title>Docs: Single Point of Access</title><link>https://alguidelines.dev/docs/navpatterns/patterns/security/3-single-point-of-access/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/docs/navpatterns/patterns/security/3-single-point-of-access/</guid><description>
|
||
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
|
||
<p><a href="Logo-_2D00_-Single-Point-of-Access.png"><img src="Logo-_2D00_-Single-Point-of-Access.png" alt=" "></a></p>
|
||
<p><strong>Context</strong>: Protected data needs to be used. There are many types of entities which might attempt to use the data.</p>
|
||
<p><strong>Problem</strong>: If no standard way of accessing data exists, then each entity might attempt to build its own system for handing the sensitive data. The data access layer might be implemented over and over again by each entity, without reuse of known best practices and with a lot of code duplication.</p>
|
||
<p><strong>Forces:</strong></p>
|
||
<ul>
|
||
<li><strong>Code duplication:</strong> if each entity attempts to write its own routines for data access, invariably this will bring duplication.</li>
|
||
<li><strong>No knowledge reuse:</strong> if a bug is found and fixed in one of the implementations, there is no guarantee that all the other implementations will be updated. For example
|
||
<ul>
|
||
<li><strong>Double-Encryption</strong>: lack of care or knowledge could lead a NAV developer to attempt to double-encrypt strings, which would render them unusable.</li>
|
||
<li><strong>Multi-company configuration [4]</strong>: in NAV, it is possible to store multiple companies on the same tenant [5] database. A developer who has not investigated such a configuration and its consequences on encryption, can attempt to encrypt data in (for example) a Setup Table [6] of only one company, which would make this table unusable from any unencrypted company (since the server will observe that encryption is enabled, and try to retrieve it as it were enabled for all companies and fails).</li>
|
||
<li><strong>&ldquo;Shotgun surgery&rdquo; [7]:</strong> one change in the data access technique (like a new requirement to validate the user&rsquo;s identity before viewing any protected data), calls for updates in every single implementation of data access, if multiple implementations exist. Hence, one change of requirement triggers multiple efforts to update the product.</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
<p><strong>Solution:</strong> In Dynamics NAV the same library which offers <a href="https://alguidelines.dev/navpatterns/1-patterns/security/2-data-encryption/"><strong>Encryption</strong></a>, is also intended to be used as a <strong>Single Point of Access</strong>. Write code to create, read and remove sensitive data only through codeunit 1266 Encryption Management, and never directly.</p>
|
||
<p>In Figure 9 (figure numbering is continued from pattern <strong><a href="https://alguidelines.dev/navpatterns/1-patterns/security/2-data-encryption/">Encryption</a></strong>), the panels 1, 2 and 3 have applied the <a href="https://alguidelines.dev/navpatterns/1-patterns/security/1-sensitive-data-encapsulation/"><strong>Sensitive Data Encapsulation</strong></a> and <a href="https://alguidelines.dev/navpatterns/1-patterns/security/2-data-encryption/"><strong>Encryption</strong></a> patterns. Once data is encapsulated, no matter if it has been encrypted or not, the next pattern, <strong>Single Point of Access</strong>, becomes available as seen in the panels 2 and 3 of Figure 1.</p>
|
||
<p>You can observe that, in panel 3, each usage needs to access separately the encrypted data. This means that each usage needs to implement again the encryption capabilities. This is resolved in panel 4, where all users access one common API which encrypts, hence the workload of encryption is moved from the usages, to the API, and needs to be implemented only once.</p>
|
||
<p><a href="Multi-_2D00_-1-2-3-4.JPG"><img src="Multi-_2D00_-1-2-3-4.JPG" alt=" "></a></p>
|
||
<p><em>Figure 1- <strong>Single Point of Access</strong> pattern applied.</em></p>
|
||
<p>This shows how pattern application is an iterative process, where one step follows another. Refactoring [8] the code to apply one pattern, cleans and clarifies the code and in some cases, makes clear the possibility of further refactoring.</p>
|
||
<p><strong>Usage</strong>: call the procedures available in codeunit 1266 Encryption Management to store and access sensitive data.</p>
|
||
<p><strong>Benefits:</strong></p>
|
||
<ul>
|
||
<li><strong>Simplicity</strong>: only one implementation exists.</li>
|
||
<li><strong>Knowledge reuse</strong>: if a bug is found and fixed, there is just one place which needs to be repaired. Therefore, there is no risk that some of the usages would still be flawed by the same bug. For example:
|
||
<ul>
|
||
<li><strong>Double encryption</strong>: The <strong>Single Point of Access</strong> API already implements knowledge to avoid encryption of already encrypted strings.</li>
|
||
<li><strong>Multi-company</strong>: The <strong>Single Point of Access</strong> API already implements knowledge for handling encryption in a multi-company setup.</li>
|
||
<li><strong>Easy maintenance</strong>: a change in specification needs only one code update.</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
<p><strong>Consequences:</strong></p>
|
||
<ul>
|
||
<li><strong>Single point of failure:</strong> A defect in the access library will affect all usages until it is found and fixed.</li>
|
||
</ul>
|
||
<p><strong>References</strong></p>
|
||
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Separation_of_concerns">https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
|
||
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx">https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
|
||
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Binary_large_object">https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
|
||
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
|
||
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
|
||
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href="https://community.dynamics.com/nav/w/designpatterns/76.setup-table">https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
|
||
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Shotgun_surgery">https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
|
||
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
|
||
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Data_masking#Masking_out">https://en.wikipedia.org/wiki/Data_masking#Masking_out</a>. [Accessed 29 7 2016].</p>
|
||
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href="https://azure.microsoft.com/en-us/services/key-vault/">https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
|
||
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
|
||
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href="http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm">http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p></description></item><item><title>Docs: Masked Text</title><link>https://alguidelines.dev/docs/navpatterns/patterns/security/4-masked-text/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/docs/navpatterns/patterns/security/4-masked-text/</guid><description>
|
||
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
|
||
<p><a href="Logo-_2D00_-Masked-Text.png"><img src="Logo-_2D00_-Masked-Text.png" alt=" "></a></p>
|
||
<p><strong>Aliases:</strong> Masking out</p>
|
||
<p><strong>Context</strong>: In the user interface (UI) of a software system, the user enters protected information such as a password, an access key, a credit card number etc.</p>
|
||
<p><strong>Problem</strong>: The entered information is visible during data entry and whenever any user (the one who entered the data, or a foreign user) opens the UI.</p>
|
||
<p><strong>Forces:</strong></p>
|
||
<ul>
|
||
<li><strong>Information disclosure:</strong> sensitive data is visible in the UI.</li>
|
||
</ul>
|
||
<p><strong>Solution:</strong> Use the &ldquo;Masked&rdquo; field property to display dots instead of characters on the sensitive text field in the UI.</p>
|
||
<p><strong>Usage:</strong> Figure 1 shows how an unmasked and a masked field look in Dynamics NAV. On page Microsoft Dynamics CRM Connection Setup, the first two fields (Dynamics CRM URL and User Name) are not masked. The next field (Password) is masked. As the user types text into the Password field, the characters are one by one replaced with dots. When the user had finished typing and had left the Password field (moved focus to another page element), then a pre-defined number of dots is showed in the field, no matter what the real length of the password is. This is done so that the length of the text is not disclosed. Hence, no matter if the text had 5, 10 or 20 characters, as soon as the user leaves the masked field, 10 dots will be visible.</p>
|
||
<p><a href="Masking-_2D00_-CRM-Connection-Setup-page.PNG"><img src="Masking-_2D00_-CRM-Connection-Setup-page.PNG" alt=" "></a></p>
|
||
<p><em>Figure 1 - The field &ldquo;Password&rdquo; is masked.</em></p>
|
||
<p>To apply this pattern in Dynamics NAV, the developer has two choices:</p>
|
||
<ol>
|
||
<li><strong>Mask everywhere</strong></li>
|
||
</ol>
|
||
<p>Mask the field in all pages which expose it or will expose it in the future. In this case, masking needs to be set at the table level, by opening the table in design mode and setting the field&rsquo;s property ExtendedDatatype=Masked.</p>
|
||
<ol start="2">
|
||
<li><strong>Mask only in selected pages</strong></li>
|
||
</ol>
|
||
<p>Mask the field in only a subset of pages. Open the pages where the field should be masked in design mode, open the property page for the field in question, and set ExtendedDatatype=Masked. This option can be used for example when a field should be hidden from most users (in most usual pages), but still visible to administrators in specific pages.</p>
|
||
<p><strong>Benefits:</strong></p>
|
||
<ul>
|
||
<li><strong>Information protection</strong>: sensitive data is stored and can be used by the system, but once entered it is not visible in the UI anymore.</li>
|
||
</ul>
|
||
<p><strong>Drawbacks:</strong></p>
|
||
<ul>
|
||
<li><strong>&ldquo;Forgotten password&rdquo;:</strong> the text in a masked field is hidden from all users, including users who theoretically have the right to see it. In this case, if the developer wishes to disclose the text only to certain users, they have to write extra code (like a lookup trigger) which will verify the user&rsquo;s permissions and if permitted, show or send the clear-text value to the user who requested it.</li>
|
||
</ul>
|
||
<p><strong>References</strong></p>
|
||
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Separation_of_concerns">https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
|
||
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx">https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
|
||
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Binary_large_object">https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
|
||
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
|
||
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
|
||
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href="https://community.dynamics.com/nav/w/designpatterns/76.setup-table">https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
|
||
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Shotgun_surgery">https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
|
||
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
|
||
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Data_masking">https://en.wikipedia.org/wiki/Data_masking</a>#Masking_out. [Accessed 29 7 2016].</p>
|
||
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href="https://azure.microsoft.com/en-us/services/key-vault/">https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
|
||
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
|
||
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href="http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm">http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p></description></item><item><title>Docs: SSL in NAV</title><link>https://alguidelines.dev/docs/navpatterns/patterns/security/5-ssl-in-nav/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://alguidelines.dev/docs/navpatterns/patterns/security/5-ssl-in-nav/</guid><description>
|
||
<p><em>By Bogdana Botez at Microsoft Development Center Copenhagen</em></p>
|
||
<p><a href="Logo-_2D00_-SSL.JPG"><img src="Logo-_2D00_-SSL.JPG" alt=" "></a></p>
|
||
<p><strong>Context</strong>: The security of data transmission is just as important as the security of data storage. When data is transmitted over the web, Secure Sockets Layer (SSL) is available to be used with the web client in Dynamics NAV. Microsoft&rsquo;s NAV cloud solution has SSL enabled by default. However, if a partner company chooses to deploy their own NAV, then they need to handle SSL explicitly.</p>
|
||
<p><strong>Problem</strong>: Although data is stored securely, before it even gets to be stored, it needs to travel the web on a client-server connection, where it is vulnerable.</p>
|
||
<p><strong>Forces:</strong></p>
|
||
<ul>
|
||
<li><strong>Insecure communication:</strong> When the user enters a password, if unprotected, a network sniffer [12] could catch and read it. A sniffer is either a software program or hardware device which examine network traffic. Years ago, sniffers were tools used exclusively by professional network engineers, but nowadays, they are also popular with Internet hackers and people just curious about networking. A public Wi-Fi network could easily be eavesdropped by an unwanted actor.</li>
|
||
</ul>
|
||
<p>By using data storage patterns like <strong>Sensitive Data Encapsulation</strong>, <strong>Encryption, Single Point of Access</strong> or <strong>Azure Key Vault</strong>, the sensitive data is preserved securely in the implementation of Dynamics NAV. But before it gets into a secure store, this data needs to be transmitted from the user, through a user interface, on a client-server connection and all the way to the database. Is the data safe while being transmitted?</p>
|
||
<p><strong>Solution:</strong> To protect the data before it reaches the server, remember to configure SSL (Secure Sockets Layer) in Dynamics NAV.</p>
|
||
<p><em>SSL</em> is a web protocol that encrypts data that is transmitted over a network to make the data and the network more secure and reliable. A website that is enabled with SSL uses Hypertext Transfer Protocol Secure (HTTPS) instead of Hypertext Transfer Protocol (HTTP) as a communication protocol.</p>
|
||
<p>Figure 1 shows data communication between the client (where the user enters data) and the server (which connects further to the database). Without encryption (left side), data is available in clear text over the wire. A person equipped with a network sniffer can easily intercept and read it. On the right side of the picture, SSL is used to encrypt the user&rsquo;s data. Sniffing the traffic would capture the encrypted stream, but access to the real content would be impeded by encryption.</p>
|
||
<p><a href="SSL-_2D00_-before-and-after.PNG"><img src="SSL-_2D00_-before-and-after.PNG" alt=" "></a></p>
|
||
<p><em>Figure 1 - Data transmission before (http://&hellip;) and after SSL encryption (https://&hellip;).</em></p>
|
||
<p><strong>Usage</strong>: the latest information about how to configure SSL for the web client in Dynamics NAV is found online at on MSDN at <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>.</p>
|
||
<p><strong>Benefits:</strong></p>
|
||
<ul>
|
||
<li><strong>Secure communication</strong>: encryption protects the data transmitted over a network, so the data is safe all the way on its journey from the user to the database.</li>
|
||
</ul>
|
||
<p><strong>Consequences:</strong></p>
|
||
<ul>
|
||
<li><strong>Awareness:</strong> a NAV system administrator might not be aware that they need to enable SSL when using the web client.</li>
|
||
<li><strong>Extra work:</strong> there is extra effort to enable SSL on a self-administered NAV system. The good news is that Microsoft&rsquo;s cloud NAV solution has SSL by default and no extra work is required from the developer on that aspect.</li>
|
||
</ul>
|
||
<p><strong>References</strong></p>
|
||
<p>[1] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Separation_of_concerns">https://en.wikipedia.org/wiki/Separation_of_concerns</a>.</p>
|
||
<p>[2] &ldquo;GUID Structure,&rdquo; [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx">https://msdn.microsoft.com/en-us/library/aa373931(VS.85).aspx</a>.</p>
|
||
<p>[3] &ldquo;Wikipedia,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Binary_large_object">https://en.wikipedia.org/wiki/Binary_large_object</a>.</p>
|
||
<p>[4] waldo, &ldquo;How Do I: Manage Companies in Microsoft Dynamics NAV 2013 R2&rdquo;.</p>
|
||
<p>[5] Microsoft, &ldquo;Multitenant Deployment Architecture,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/dn271675(v=nav.90).aspx</a>.</p>
|
||
<p>[6] B. Botez, &ldquo;Setup Table design pattern,&rdquo; Microsoft, 2013. [Online]. Available: <a href="https://community.dynamics.com/nav/w/designpatterns/76.setup-table">https://community.dynamics.com/nav/w/designpatterns/76.setup-table</a>. [Accessed 31 07 2016].</p>
|
||
<p>[7] &ldquo;Shotgun Surgery,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Shotgun_surgery">https://en.wikipedia.org/wiki/Shotgun_surgery</a>. [Accessed 31 07 2016].</p>
|
||
<p>[8] M. Fowler, Refactoring: Improving the design of existing code, Addison Wesley, 1999.</p>
|
||
<p>[9] &ldquo;Masking out,&rdquo; [Online]. Available: <a href="https://en.wikipedia.org/wiki/Data_masking#Masking_out">https://en.wikipedia.org/wiki/Data_masking#Masking_out</a>. [Accessed 29 7 2016].</p>
|
||
<p>[10] &ldquo;Key Vault,&rdquo; Microsoft, [Online]. Available: <a href="https://azure.microsoft.com/en-us/services/key-vault/">https://azure.microsoft.com/en-us/services/key-vault/</a>.</p>
|
||
<p>[11] &ldquo;How to: Configure SSL to Secure the Connection to Microsoft Dynamics NAV Web Client,&rdquo; Microsoft, [Online]. Available: <a href="https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx">https://msdn.microsoft.com/en-us/library/hh167264(v=nav.90).aspx</a>. [Accessed 2 8 2016].</p>
|
||
<p>[12] &ldquo;sniffer,&rdquo; [Online]. Available: <a href="http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm">http://compnetworking.about.com/od/networksecurityprivacy/g/bldef_sniffer.htm</a>. [Accessed 02 08 2016].</p></description></item></channel></rss> |