Chapter 6. Security 133
The complete security cycle begins with code creation through data loading, storage, and 
access, and ends with data (and index) expiration. The following list outlines different types of 
security that are described in this chapter. Within each type, different security techniques can 
be implemented.
/SM590000Code creation:
– Controlled environment
– Code scanning
– Quality assurance testing
/SM590000Data separation:
– Multiple systems: Allowing users access only to the system that contains data that is 
relevant to them
– Multiple object servers
– Multiple archive subsystems
– Application programming interface (API) access: Web server, web services, and 
Content Management Interoperability Services (CMIS)
/SM590000Data security:
– Administrative features: Login inactivity, disabling a user, locking out a user, and 
defining password rules
– Content Manager OnDemand data model: Application groups (AGs) and folders 
– Query restrictions
– Annotation security
– Securing access to Content Manager OnDemand commands (stash file)
/SM590000Data encryption:
– Data at Rest
– Data in Motion: Secure communication between the server and the clients (Secure 
Sockets Layer (SSL))
/SM590000Security exits:
– User security and permissions exit ( ARSUSEC)
– Unified logon exit ( ARSPTGN)
– System log exit
6.2  Code security
The Content Manager OnDemand code is developed in a secure environment that follows 
IBM guidelines. The Content Manage OnDemand development lab follows multiple preferred 
practice methodologies to ensure the highest possible code and security standards. The goal 
is to ensure that the code “works as designed”, does not perform any malicious actions, and 
is resistant to external security breach attempts. In this section, we describe examples of the 
practices that are followed.