By now you will probably have heard of the infamous Edward Snowden, who stole data that was held by the NSA then decided to announce key parts of it publicly. Well last week we actually found out that our best mate SharePoint, may have been a guilty party to!
First the facts…
To discover the source of this announcement watch this video and watch from about 27 minutes. The key phrase Alexander uses is “This leaker was a System Administrator and ran the SharePoint account at NSA Hawaii, so his responsibility was to move data..”
Interestingly, if you watch from 45:15, you will also hear “This leaker was a System Administrator who was trusted with moving information to actually make sure the right information was on the SharePoint Servers that NSA Hawaii needed.” This makes it sound as though he was loading it into SharePoint ,rather than downloading it.
This is contrary to a few reports that came out last week such as :
- ‘NSA chief leaks info on data sharing tech: It’s SharePoint‘ by the Register.
Anyway, for the purposes of this discussion, let’s get some artistic license and assume it WAS in SharePoint 😉
My question is to both SharePoint Administrators and Developers alike! What can we do to make SharePoint more secure and could this have been prevented ? All though they don’t say, let’s make the assumption that the data was stored in standard document libraries.
To help frame the answer, think about :
- What technologies in SharePoint and available as an add-on can we use ? (Some promo is fine 😉
- How can we ensure that the currently logged on user is that user ? Are there different log-on mechanisms that simple user name and password ?
- Can we encrypt the data in SharePoint ?
- Can we audit who, what, when where ?
- Can we put some extra controls in when the documents are being downloaded ?
- Can we lock down Sys Admin privileges ?
- Can we require certain actions in SharePoint to need two users to approve ?
- If he was a SysAdmin could he just go straight to the database ?
If you can’t answer all the questions that’s expected! If you know about a particular area, e.g. auditing then share your knowledge on that. Maybe there’s a nice reference document to be made out of all the answers! Share your experiences, especially if you have worked on a SP farm that requires security clearance!
Hi Raul,
We’ve recently released a whitepaper titled “Managing Information Risk for Microsoft SharePoint“. The White Paper discusses the goals and challenges of information governance in SharePoint environments and reveals five of the most common information governance objectives for SharePoint deployments.
It is free for reviewing and downloading on our website. You can also see the doc on SlideShare. Here is the reference link. (http://www.slideshare.net/nextlabs/managing-information-risk-for-mi…)
Best,
Kate
It’s an interesting discussion. What I’ve learned from our SharePoint expert, regarding the question of data encryption, is that data can be automatically encrypted on upload to SharePoint, or encrypted once within SharePoint with batch processing, using a Rights Management solution.
About Audit, RM solution can also provide Audit and Reporting (users, type of data accessed, when, on which computer, from which IP address, etc.) capability for SharePoint, through a comprehensive central activity journal and analysis engine with a flexible web-based reporting application. Dashboard, custom and standard reports show access rights, access attempts, authorization decisions, end user activity and trend analysis. We provides the comprehensive rights management solutions for SharePoint. (The link is for your reference)
Is there any reference documents to be make out for rest of the answers?
I totally agree. I think it was the user that leaked it.
