WP SharePoint Playbook

7/29/2019 WP SharePoint Playbook

1/15

SharePoint Security Resource Kit

SharePoint Security Playbook

5 Lines of Defense You Need to Secure Your SharePoint Environment
https://www.imperva.com/ld/sharepoint_resource_kit.asphttps://www.imperva.com/ld/sharepoint_resource_kit.aspmailto:?subject=SharePoint%20Security%20Playbook&body=It%E2%80%99s%20time%20to%20think%20about%20SharePoint%20Security.%20I%20thought%20you%20might%20like%20this%20free%20eBook%20from%20Imperva:%20SharePoint%20Security%20Playbook%20-%20http://bit.ly/PJp0Hihttp://www.linkedin.com/cws/share?url=http%3A%2F%2Fblog.imperva.com/2012/07/sharepoint-security-playbook-ebook.html&original_referer=&token=&isFramed=false&lang=en_US&_ts=1339694687144.0002http://www.facebook.com/sharer/sharer.php?u=http%3A%2F%2Fbit.ly/PJp0Hi&t=Sharepoint+Security+Playbook+-+Imperva+Data+Security+Blog&src=sphttps://twitter.com/intent/tweet?source=webclient&text=Reading+%40Imperva%27s+free+eBook%3A+SharePoint+Security+Playbook++http%3A%2F%2Fbit.ly%2FPJp0Hi


2/15


Contents

ITS TIME TO THINK ABOUT SHAREPOINT SECURITY

Challenge 1: Ensure access rights remain aligned with business needs

Challenge 2: Address compliance mandatesChallenge 3: Respond to suspicious activity in real time

Challenge 4: Protect Web applications from attack

Challenge 5: Take control when migrating data

Conclusion: SharePoint Security Checklist

ABOUT IMPERVA


3/15


Its Time to Think about SharePoint Security

The increasing use of Microsoft SharePoint to store sensitive business data and extend

access and collaboration to partners, customers, and suppliers has outpaced native SharePoint

security capabilities. More and more organizations are storing and accessing sensitive, regulated

information through this platform. To improve business security, organizations must invest in

organizing, managing, and protecting these valuable assets. By implementing the ve lines of

defense outlined in this playbook, you will be able to overcome operational challenges and

protect your SharePoint deployments against both internal and external threats.


4/15


Ensure access rights remainaligned with business needs.

CHALLENGE #1

SharePoint Security GapWithout an aggregated, centralized system to view rights

information, SharePoint permissions for each site collection

must rst be extracted to an Excel spreadsheet and then

combined by hand to analyze. And, that analysis must be

done manually within Excel or exported yet again to a

third-party analytics platform.

Unstructured datanow accounts formore than 90% ofthe Digital Universe.

-IDC 2011


5/15


Ensure access rights remain aligned with business needs.

The PlayAggregate permissions across the entire SharePoint deployment and

automate the review process to keep rights aligned with business needs.

The Advantage- Understand who has access to what data or, conversely, what data any given

user or group can access, and how that access was assigned or inherited.

- Simplify the process of identifying where excessive access rights have been

granted, if there are dormant users, and who owns each item and document.

- Help administrators and data owners establish a baseline snapshot of access

rights and conduct rights reviews.

CHALLENGE #1


6/15


Address compliance mandates.

CHALLENGE #2

SharePoint Security GapNative SharePoint activity monitoring lacks an intuitive,easy-to-use interface for reporting and analytics. Without

a third-party solution, businesses must rst decode

SharePoints internal representation of log data before

they can access meaningful information.

60% of organizationshave yet to bring SharePointinto line with existing data

compliance policies.-AIIM 2011


7/15


Address compliance mandates.

The PlayUse enterprise-class technology that combines permissions and activity

details to automate compliance reporting.

The Advantage- Generate compliance reports on-time and tailored to each recipients needs.

- Drill down, lter, and organize data.

- Enrich native data with relevant information, such as type of data, department,

and data owner.

CHALLENGE #2


8/15


Respond to suspiciousactivity in real time.

CHALLENGE #3

SharePoint Security GapNative SharePoint activity auditing does not provide

the ability to automatically analyze access activity

and respond with an alert or block.

96% of breacheswere avoidable throughsimple or intermediatecontrols.

-Verizon Data Breach Report 2011


9/15


Respond to suspicious activity in real time.

The PlayUse a policy framework to build rules across SharePoints Web,

le, and database components to identify suspicious behavior and

complement native access controls.

The Advantage- Monitor, control, and respond to suspicious activity in real time.

- Balance the need for trust and openness with security concerns.

?!

CHALLENGE #3


10/15


Protect Web applicationsfrom attack.

CHALLENGE #4

SharePoint Security GapNative SharePoint does not include Web

application rewall protection.

31% of organizations are usingSharePoint for externally facing

Web sites, and another 47%

are planning to do so.

-Forrester Research, Inc. 2011

CHALLENGE #4


11/15


Protect Web applications from attack.

The PlayDeploy a proven Web application rewall (WAF) technology.

The Advantage- Provide a powerful defense against common attacks, such as SQL injection

and cross-site scripting.

- Streamline and automate regulatory compliance.

- Mitigate data risk.

Keep Out(PLEASE)

SharePoint

ADMIN

DATABASE

CHALLENGE #4


12/15


Take control whenmigrating data.

CHALLENGE #5

SharePoint Security GapSharePoint enforces access controls for les using

Access Control Lists (ACLs). What makes native

permissions challenging, however, is that SharePoint

lacks an automated way to ensure that ACLs remain

aligned with business needs.

SharePoint 2010deployments grew5x in the pastsix months.

-Global 360 2011

CHALLENGE #5


13/15


Take control when migrating data.

The PlayIdentify where excessive access rights have been granted, and use le

activity monitoring to locate stale data that can be archived or deleted.

The Advantage- Keep rights aligned with business needs.

- Free up storage space and reduce the amount of data that must be

actively managed.

CHALLENGE #5


14/15


SharePoint Security Checklist

Get ahead of all SharePoint deploymentsImplement a SharePoint governance policyPut security requirements in place when SharePoint instances go liveLook beyond native SharePoint security featuresSpecify what kind of information can be put on SharePoint

Concentrate on business-critical assets rstStart with regulated, employee, or proprietary data,and intellectual propertyStreamline access to a business need-to-know levelIdentify and clean up dormant users and stale dataAlert on unauthorized accessEstablish a regular review cycle for dormant users, stale data,and excessive rights

Work with data owners to manage user accessLocate data ownersCreate permission reports so data owners have visibility intowho can access their dataValidate with owners that access to data is legitimateCreate usage reports so owners can see who is accessingtheir data

Jump start your Microsoft SharePoint security efforts with this quick reference guide

Protect Web sites from external attackIdentify SharePoint Web applications that work with sensitive dataDeploy a Web application rewall to monitor and protect sensitive SharePointWeb sites, portals, and intranetsRespond to suspicious activity such as external users accessing admin pages

Enable auditing for compliance and forensicsWho owns this data?Who accessed this data?When and what did they access?Have there been repeated failed login attempts?
https://www.imperva.com/ld/sharepoint_resource_kit.asphttps://www.imperva.com/ld/sharepoint_resource_kit.aspmailto:?subject=SharePoint%20Security%20Playbook&body=It%E2%80%99s%20time%20to%20think%20about%20SharePoint%20Security.%20I%20thought%20you%20might%20like%20this%20free%20eBook%20from%20Imperva:%20SharePoint%20Security%20Playbook%20-%20http://bit.ly/PJp0Hihttp://www.facebook.com/sharer/sharer.php?u=http%3A%2F%2Fbit.ly/PJp0Hi&t=Sharepoint+Security+Playbook+-+Imperva+Data+Security+Blog&src=sphttp://www.linkedin.com/cws/share?url=http%3A%2F%2Fblog.imperva.com/2012/07/sharepoint-security-playbook-ebook.html&original_referer=&token=&isFramed=false&lang=en_US&_ts=1339694687144.0002https://twitter.com/intent/tweet?source=webclient&text=Reading+%40Imperva%27s+free+eBook%3A+SharePoint+Security+Playbook++http%3A%2F%2Fbit.ly%2FPJp0Hi


15/15


Imperva Headquarters

3400 Bridge Parkway, Suite 200Redwood Shores, CA 94065

Tel: +1-650-345-9000

Fax: +1-650-345-9004

Toll Free (U.S. only): +1-866-926-4678

www.imperva.com

Co i ht 2012 I I c All i ht d I th I lo o d S c S h t d k of I I c All oth b d o od ct t d k o i t d t d k of th i cti hold

About Imperva

Imperva data security solutions provide visibility and control of high-value business data

across critical systems within the data center. Imperva SecureSphere includes database, le,

and Web application security solutions that prioritize and mitigate risks to business data,

protect against hackers and malicious insiders, and streamline regulatory compliance.

Find Us on the Web | Contact Us Direct | Read our Blog | Facebook | Twitter | SlideShare | YouTube
https://www.imperva.com/ld/sharepoint_resource_kit.asphttp://www.imperva.com/https://www.imperva.com/products/fsc_sharepoint.htmlhttps://www.imperva.com/ld/sharepoint_specialist.asphttp://blog.imperva.com/http://www.facebook.com/impervahttps://twitter.com/#!/impervahttp://www.slideshare.net/Impervahttp://www.youtube.com/user/ImpervaChannelhttp://www.youtube.com/user/ImpervaChannelhttp://www.slideshare.net/Impervahttps://twitter.com/#!/impervahttp://www.facebook.com/impervahttp://blog.imperva.com/https://www.imperva.com/ld/sharepoint_specialist.asphttps://www.imperva.com/products/fsc_sharepoint.htmlhttp://www.imperva.com/https://www.imperva.com/ld/sharepoint_resource_kit.aspmailto:?subject=SharePoint%20Security%20Playbook&body=It%E2%80%99s%20time%20to%20think%20about%20SharePoint%20Security.%20I%20thought%20you%20might%20like%20this%20free%20eBook%20from%20Imperva:%20SharePoint%20Security%20Playbook%20-%20http://bit.ly/PJp0Hihttp://www.linkedin.com/cws/share?url=http%3A%2F%2Fblog.imperva.com/2012/07/sharepoint-security-playbook-ebook.html&original_referer=&token=&isFramed=false&lang=en_US&_ts=1339694687144.0002http://www.facebook.com/sharer/sharer.php?u=http%3A%2F%2Fbit.ly/PJp0Hi&t=Sharepoint+Security+Playbook+-+Imperva+Data+Security+Blog&src=sphttps://twitter.com/intent/tweet?source=webclient&text=Reading+%40Imperva%27s+free+eBook%3A+SharePoint+Security+Playbook++http%3A%2F%2Fbit.ly%2FPJp0Hi

Documents

WP SharePoint Playbook