As SharePoint has proliferated across the landscape there has been a phase shift in how organizational information is
kept secure. In one aspect, business assets are more secure employing a formally built and community tested Microsofttechnology. This is in stark contrast to the past model where each organization tried to home grow web applications
from scratch with internal resources; some web teams more experienced than others on security. However the flip side isthat with SharePoint so easy to install via the wizard, thousands of SharePoint portals were created in a cavalier fashionwithout formal security model and thus vulnerable to exploit or compromise.

This issue of The SharePoint CollaborusTM addresses 10 key elements that help to achieve a security posture with yourorganization’s SharePoint implementation. While not a recommendation for a specific model, each role below outlines alayer that when combined with other layers provide progressively higher levels of security. The key in addressing thesecurity of your SharePoint platform is to ensure that each role is addressed and a formal model adopted based on therisk your organization can accept and resources it can provide.

#ROLE

DESCRIPTION / BENEFITISSUES / RISKS

1

Dedicated
Web Team

Managing trust boundaries vertically and horizontally in asite collection is an engineering discipline. SharePoint’s
easy web tools provide a management capability, butdoes not provide the ability for a user to know how tomanage security. Essentially, the product’s capacity forsecurity is dependent on the administrator’s capabilities
which come from formal training and experience.

It is critical to appoint trained
professionals to manage security. 99%
of all SharePoint security violations
are due to SharePoint purposefully
being told to associate UserA toAccessLayerB by a user not trained on
security modeling.

2Dedicated
Network IT
Staff

Governing enterprise hardware is not an ancillary
responsibility when there’s time to do so, rather it’s thecore competency of an IT professional. In addition to theyears of experience and certifications one must have, aNetwork Engineer is more aware of the variables toharden and monitor an environment; not just using thewizard to set it up.

3NetworkOperations
CenterPhysical controls are just as important as virtual ones.
Even with all other security layers added, an environment
can be easily compromised if servers are sitting on a deskor in rental offices. Access control to the building, NOC,cabinet and machine all provide layers of security and areimportant. Each datacenter has different levels of physicalsecurity in place and may vary whether they use keys,electronic, and/or biometric access controls.

4Secure Socket
LayersAdding SSL to a website allows packets of data
(representing the file or web page) to be transferred
between the server and the destination computer in an561.999.8888

www.softwarefx.com

800.392.4278

The IIS worker process that is
responsible for crawling content forthe search indexes cannot crawl in anencrypted state. This ensures that any potential “listener”
of the session would not be able to see the contents of thetransmission. Employing SSL may be helpful to add if theSharePoint portal is deployed as an extranet, or istransmitting potentially sensitive/proprietary content.
5Authentication
MethodIntegrated Windows Authentication relies on Kerberos
authentication protocols and is more secure forauthenticating into SharePoint sites. It is encouraged touse it, however many SharePoint sites are demoted tousing BASIC authentication which is less secure.

6Dual Factor

Dual factor authentication provides advanced security forwebsites and relies on:

AuthenticationA) Something a user knows (ie: a password)B) Something a user has (ie: Key Fob, thumb print,etc)

encrypted state. Thus going with SSL
kills indexing and search results. A
locked down, non‐SSL local mirror on
the same server is required to sustain
indexing and search results.

Between licensing and hardware forevery user (ie: key fobs), dual factor
authentication has historically beenvery expensive to implement.
Additional costs are incurred toprovide staffing resources to train andsupport users adoption of Dual Factor
authentication.

Employing both factors in concert ensure that the system
is not vulnerable if a user’s password is shared orcompromised.
7Domain
Policies

Through effective use of Group Policy, all domain users
can have requirements on their system accounts.
Standards vary based on the SOPs of the organization, but
usually include having a password of minimum length,
using special characters, and enforcing expirations toensure passwords are changed regularly.

8

Intrusion &Virus
Detection

Employed to detect several types of malicious behaviors
that can compromise the security and trust of a computer
system, an intrusion detection system is software and/or
hardware designed to detect unwanted attempts ataccessing, manipulating, and/or disabling of computer
systems for threats from the outside. This includes
network attacks against vulnerable services, data driven
attacks on applications, host based attacks such asprivilege escalation, unauthorized logins and access tosensitive files, and malware (viruses, trojan horses, andworms).

9Server
Maintenance
Schedules

Server maintenance includes all physical and virtual
servers in the farm, their operating systems, and add‐ons
such as SQL server or SharePoint. As new vulnerabilities ordesign flaws are discovered, Microsoft issues hotfixes,
561.999.8888

www.softwarefx.com

800.392.4278

If a full extranet where users are noton LAN terminals, additional
enhancements to SharePoint need tobe made to provide the password
management, notification and reset
tools normally provided through anetwork login.

Windows Updates, and Service Packs. When risks arelogged by the community, network engineers must gauge
whether the maintenance should fall in the next scheduled
window, or based on the organization’s SOPs be fast
tracked for immediate implementation.
10

Virtual Private
Network
TunnelThough use of a VPN, a SharePoint site can be restricted
to LAN access only which ensures there is no remote
access. However, that level of restriction excludes bothpotential hackers and staff alike. Making a SharePoint
only accessible from a VPN does ensure only VPN users
can access it, but simultaneously demotes it from an
Extranet to an Intranet.

561.999.8888

www.softwarefx.com

800.392.4278

Users will always have an added
sequence of steps to participate in theenvironment which may limit their
participation. Additionally, an increasein support staff is required to train
users how to download, install, andconnect into the VPN environment.