Webinar with Joel Oleson and Antonio Maio: Take Control of SharePoint Security

1. Join the Conversation
#SharePointSecurity
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

2. joel.oleson@gmail.com
Joel Oleson sharepointjoel.com
SharePoint Evangelist
SharePoint Joel @joeloleson
LDS Solutions Manager
Antonio Maio
Antonio.Maio@titus.com
Microsoft SharePoint MVP
Senior Product Manager
TITUS
@AntonioMaio2
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

3. Data in SharePoint…
Now What???
Visit Joel Oleson @ www,sharepointjoel.com
WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

4. Is Your Information Architecture Plan
A House of Cards?
Visit Joel Oleson @ www,sharepointjoel.com
WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

5. Governance vs. Security
 Governance provides structure, oversight, and
management to organize a successful deployment with
proper roles and responsibilities with agreed on
processes on a technology
 Security - Preventing unauthorized access. Precautions
to guard against potential leaks or crimes.
WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

6. Governance & Security
Governance
Security
Visit Joel Oleson @ www,sharepointjoel.com
WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

7. Why is CISO and the Security Team
Afraid of SharePoint?
 They see that’s where the data is or is moving
 Yikes! Search works
 Security by Obscurity doesn’t work anymore
 Delegation is a scary proposition
 Uncle Ben was right about responsibility- With power
comes great responsibility
WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

8. Visit Joel Oleson @ www,sharepointjoel.com
WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

9. Polling Question #1
 Which of the following sensitive information do you
need to protect in SharePoint? Check all that apply:
 Financial Information
 Human Resource Information
 Health Information
 Personally Identifiable Information
 Intellectual Property
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

10. Trends in SharePoint Content
 Sensitive content sitting
beside non-sensitive
content
 Content organized by
nature of information,
not by security level
 Trend in all industries,
Internal Confidential
including military and
Public
intelligence
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

11. New Security Challenges
 How do you know what
data is sensitive?
 How do you know who
Public
Internal Confidential should have access?
 How do you control
Alice Bob access to widely
Finance Research
dispersed information?
John
Partner
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

12. SharePoint Native Security
 Authentication
 Web Application Policies
 Privileged Users
 Permissions (ACL’s)
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

13. Authentication Options
Authentication Options
- Classic Mode
(Kerberos or
NTLM)
- Claims-based
Authentication
- Forms-based
Authentication
Other Non-AD
Sourcese
WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

14. Web Application Policies
Set policies for web
Web application as a whole
Application
 User policies and
permissions
Site Site
Collection Collection  Permission policies
 Authentication/sign-in
Site Site
 Anonymous access
 Blocked file types
Library List
 Web Parts
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

15. Privileged Users
Farm Administrator Site Collection  What if you have
Administrator
“Top Secret”
information in
SharePoint and
admins aren’t
cleared to see it?
- Access everything - Access everything  Integration with
- Enable/disable in site collection Microsoft RMS can
any configuration - Enable/disable
any configuration
help in this
- Uninstall server-
side applications in site collection situation
and solutions
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

16. Permissions (ACLs)
 Permissions can apply
Site to any information
Collection object or container in
SharePoint
Site Site  Hierarchical permission
model: permissions
inherited from level
Library List
above
 Breaking inheritance is
Document Folder Item a manual process
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

17. Fine-Grained Permissions & Metadata
The solution for sensitive content sitting with non-sensitive content
 Metadata to identify which
data to protect
 User attributes (claims) to
determine who should
have access
 Automation to manage
fine-grained permissions
Internal Confidential
Public
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

18. Polling Question #2
 What is your biggest challenge in SharePoint?
Check all that apply:
 Controlling access to official corporate records
 Permissions Management and site ownerships
 Secure External Access (e.g. Partners, Contractors)
 Identity Management and Authentication
 Auditing for compliance
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

19. TITUS SharePoint Security Suite
 Protect sensitive information in SharePoint by enforcing access control
policies that use Trusted Claims and Document Metadata
 Promote data governance by enforcing awareness, compliance and
accountability
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

20. Scenario
Users Store/Access Business
Content in SharePoint
Alice
Finance
Bob
Research
SharePoint
Project Library
(ex. Merger)
John
External Contractor
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

21. Scenario
Users Store/Access Business
Content in SharePoint
Alice
Finance
Internal Confidential
Internal
Bob
Research
Public
Public
Confidential SharePoint
Project Library
(ex. Merger)
John
External Contractor
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

22. Scenario
Alice only accesses content
she is permitted to access
Alice
Finance
Internal Confidential
Internal
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

23. Scenario
Bob only accesses content
he is permitted to access
Bob
Research
Public
Public
Internal
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

24. Scenario
John only accesses content
available to contractors
Public
Public
John
External Contractor
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

25. TITUS and Claims-Based Authorization
User Environment Data
SharePoint
Permissions
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

26. Administration Built into SharePoint
 Simplifies SharePoint security and data governance
Alice: Finance Team
Access Finance docs
Bob: Research Team
Access Research docs
John: External Contractor
Access Public Research docs
only
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

27. Raise User Awareness
Automatically apply standardized security labels to MS Office and PDFs
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

28. Promote End User Accountability
Mark documents with identifying information about a user when documents
come out of SharePoint
Date and
Timestamp
Current
Username
Date and
Timestamp
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

29.  Protect and Securely Share Sensitive Information
 Implement Consistent & Effective Data Governance
 Enable Dynamic Fine Grained Security
 Automate Security using Identity and Metadata
2013
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

30. Next Steps
 Discover TITUS SharePoint Security
Solutions at www.titus.com
 Sign up for a Free Trial at
www.titus.com
 Visit TITUS at Microsoft SharePoint
Conference 2012 – Booth # 865
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

31. Q&A
Joel Oleson Antonio Maio
SharePoint Expert Microsoft SharePoint MVP
SharePoint Joel Senior Product Manager
@joeloleson TITUS
@AntonioMaio2
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

32. #SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

33. Prize Giveaway
#SharePointSecurity WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |