Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

An executive at the company I work for has asked me to set the permissions on a specific network folder so only they can access it. I don't usually do this, but in this case I need advice on the best practice for this?

I was thinking along these lines:

  • Remove inherited permissions from folder
  • Remove everyone group from folder
  • Remove users group from folder
  • Ensure the user object has full permissions
  • Ensure domain admins group has full permissions

Thoughts?

Thanks.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

You're on the right track for the most part, though I disagree about the Domain Admins.

Since you mention best practice, I'll start off with stating that you should only use security groups in assigning permissions and privileges, even if there is only one member in the security group. Think role based rather than individual user based. In a smaller organization this is less important...but best practices and all.

Administrators might mean local, Domain Admins, Enterprise, or whatever is applicable to your environment...

In most cases, it would be appropriate to break inheritance as you suggest and grant access only to the user/group needing access and SYSTEM. Depending on the content and environment, many admins would also leave Administrators. The user(s) should be informed that they can lock themselves out, etc. since they are the sole owner, etc.

Special consideration should be given to backup and restore. Should this directory/share be backed up? Does your backup protect ACLs on backup/restore? Does your backup solution use the SeBackupPrivilege, which allows backups in spite of ACLs (most do, but some simple ones do not)? Security should be maintained not only in production, but through backup and restore also... This is particularly important in an environment under regulatory compliance such as SOX, HIPAA, or PCI.

Keep in mind that as an Administrator you can change ownership of the file or directory object and then change permissions to fix anything if need be. This is why Administrators is often removed from the ACL. This is generally appropriate because such activity would be logged or audited. If you only gain access by changing ownership you can't be accused of accessing sensitive data without proof ;-)

share|improve this answer
    
Thanks a lot Mike, that's great advice! I'll go ahead as advised. –  Mr. Me Jan 29 '13 at 5:41
    
You're welcome. Remember though, it's not your data, so better to discuss and balance the needs of the owner with the policy and responsibility (and possibly the legal requirements) of your role. –  Mike Jan 29 '13 at 5:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.