Security through obscurity helps no one. Write up what you know.

And put me on the distribution list for your draft. :-)

I wouldn't worry about making information public - it's out there already. It's
much more important to make sure that every admin knows how to make their
system secure.

I had the same dilemma with my 'Lock up your servers' BP session last year, but
there are open source Domino hacking tools out there already. Better to make
people aware of the risk than stick your head in the sand!!

Sounds like a great redpaper

There's never too much information available on security. If it exists,
there's a pretty good chance that the bad guys already know about it.
Especially when it's one of those situations typical of Notes/Domino
environments where the exposure and vulnurabilities tend to be due to bad
configuration or procedural issues rather than a flaw in the product itself.
There are guides out there by the NSA and other security orgs on how to lock
down Windows systems and that's not making those environments more dangerous to
be in.

Write it all up. As the other have said, the information is usually already
available to the bad guys. This is a classic debate, and I think the winner by
acclamation is always that the information should be shared.

And give serious thought to the redpaper approach, too. One negative
consequence I can see in publishing this information is that you are currently
paid for your expertise in this area. If you give away the knowledge, you
should try to do so in a way that maximizes the amount of credit you receive
for doing so. Of course, you're no fool, so I'm probably trying to teach my
grandma how to suck eggs. :D

The purpose of a Redpaper such as you describe is to educate Administrators
about how to implement security for a Domino implementation correctly.

If that also educates "script-kiddies" & other hackers at the same time, so be
it. You can't base a sound security strategy on ignorance.

Perhaps after reading the document, some hackers might even be pursuaded to
move on to easier targets.

You should even consider creating or commercializing some of your more useful
Penetration Test code as a suite of basic security tools for clients and other
Notes specialists who are less skilled in Notes/Domino security vulnerabilities
than yourself.

Please consider putting me on the distribution list for your draft as well. :-)

There is no pre-built toolkit. That's part of what I do. I go in and ask to
be set up as a new contractor or employee and take the default configuration as
given to me as the basis from which to expand my access. I do this with some
understandings in place that I won't break anything, expose data where it
shouldn't be exposed, or generally make matters worse. If I find things I
could do, I document them. When I make examples, I always use a fictitious
name so that my examples can't be taken out of context (e.g. if I can relay
mail, I may do so using an obviously fake name like 'thebossofyou@company.com'
but would never use the actual boss's name.

I don't bring in with me a kit of pre-built scripts, and usually don't plug my
laptop into their corporate network (unless I'm also testing that). My laptop
is open and powered up for reference, note taking, and is frequently connected
to the public internet by way of cellular modem -- but not through the company
network at all.

I don't dumpster dive, don't do much in the way of human engineering (though it
is insanely easy to do most of the time) and keep in my sandbox generally.
Basically, I try to avoid the "Movie of the Week" stuff. If someone wants it,
fine, but it's very expensive and a lot of time goes into ground rules.
Sneaking around like a criminal can lead to big misunderstandings and serious
problems.

That said, yes -- there are common things I look for right away. At least one
of which is very likely to work in most environments.

The thing is, there are no secret security holes that I am aware of. There are
no "zero day exploits" to take advantage of in the product that I am somehow
privy to.

So far, I'm getting responses here from Notes guys -- mostly high end,
independent types. What about the rest of you?

Rob, suppose I posted something here and you came in to work a few days later
to find that several of your end users were reading the email files belonging
to their boss? Are you saying the fecal matter wouldn't impact upon the rotary
oscillating device for you?

Oh - one more thing to add here... As far as me keeping methods and practices
a secret to protect my income -- it's not my style. I don't believe my value
is decreased just because I tell people how I do things. Lots of people can
write code. Lots of people can do most of the things I do. I'd like to think
the value I offer as a whole is larger than the sum of those parts by
themselves. If you look at any of the presentations (currently displayed
'screen left') you'll find I purposely put as much of the meat on the pages as
I can, rather than making empty bullet points you have to pay me to get value
from. That's a practice I've had some arguments with other consultants about
in the past. I think the latter practice is disgusting, and driven by fear.

I have to agree with everyone else in saying that keeping information private
doesn't make something more secure. MS has been practicing that with
Windows/Office for years and it hasn't really worked for them.

When I am wearing my Sys Admin hat (which isn't too often), I would love to
have a cheat sheet that would allow me to very quickly make sure my system is
secure. I know it wouldn't cover everything, but it would cover more than I
would discover on my own.