1

Up till now we have handled restricting access to documents by having a share on our server that only the 2 accounting people could access and another that only the 2 HR people could access. And everything else is available to everyone.

We've grown to a size where this doesn't work well. To continue with this approach we would need 5 different shares. And people will probably make mistakes putting files in the wrong share.

What should we do? We're only 32 people and I don't want to bring in some complex mess. But I do want to have a system that will work up to 100 employees.

We're a Windows shop if that makes a difference. And this is mostly DOCX & XLSX files.

ps - I figure this is a valid question, either as security policy, security tools, and/or physically securing information assets.

  • Is paper completely out of the question? – Deer Hunter Nov 4 '15 at 22:51
  • 1
    @DeerHunter - unfortunately yes. We've got people at 2 locations for some of these. – David Thielen Nov 4 '15 at 23:01
  • A separate VPN, and separate computers, then. We don't know your budget, we don't know how valuable your data are, any design will be pure guesswork. – Deer Hunter Nov 4 '15 at 23:04
  • 1
    I don't mean to be to inquisitive about what exactly is in the documents you need to protect, but can you disclose a bit more about what you consider their sensitivity level to be (if that makes sense)? I ask because a setup that (for example) would be quite adequate to protect employment records with SSNs in them or stored credit card numbers would definitely not be adequate to, say, protect critical intellectual property of a multi-national corporate client. – mostlyinformed Nov 4 '15 at 23:29
  • @halfinformed - it's the first, personnel records and the company accounting info. – David Thielen Nov 4 '15 at 23:30
3

If you have an Active Directory or similar centrally managed user system, this should be quite easy to implement. Active Directory has had Access Control baked in for over a decade now.

https://technet.microsoft.com/en-us/library/cc785913(v=ws.10).aspx is an article set from Microsoft that explains this in great detail. Roughly speaking:

  1. Create a folder system that indicates what each kind of document is for.
  2. Define an Active Directory group setup for your different teams: one for HR, one for Accounting, one for developers, one for the helpdesk, one for management and so on.
  3. For each group, configure the permissions that group should have to each folder. This can range from full permissions, read, write to no permissions.
  4. Assign all your employee AD accounts to the correct group.

If you don't have a centrally managed user system with a company of 32 employees, GET ONE ASAP. It will only make your sysadmin's life easier, and it's a worthwhile investment for a company that's going to expand to 100 or more people. In addition to access control, central user management allows for much more flexibility in user management and password management and allows you much more control over not just files, but Windows settings as well.

And people will probably make mistakes putting files in the wrong share.

This is just a matter of educating your users on proper file management. You won't be able to find a 100% technical solution unless you start going into intricate (read: unstable) in-house development projects. Use a combination of existing, well established software and user training.

  • Yep we have AD and all that set up. It sounds like I was trying to over-do this. One follow-on question, should we restrict by share, or by folder with all folders in a share? Folders in a share is what we have right now. – David Thielen Nov 4 '15 at 23:03
  • Are your shares on a centralised machine that's not used for another purpose , or are they on user machines? I'm not that familiar with implementing shared resources, so I'm probably not the best person to answer this. – Nzall Nov 4 '15 at 23:06
  • 1
    At present on a NAS box running Windows NT. – David Thielen Nov 4 '15 at 23:10
  • From what I can tell, restricting by folder gives you more control compared to restricting by share. I'm not sure though. – Nzall Nov 4 '15 at 23:17
  • 1
    The share is the more important security boundary, in my view. It's where you restrict which computers on the network can even get any access to the machine that has the shares/folders on it. If a bad guy gets access to a share but then finds he doesn't have permissions to open a particular folder he might have some options to improperly elevate privileges on the local machine and gain access as a local admin or system-level element. But if he gets denied access to the share in the first place he's left outside the machine hosting the info entirety. At least, that's how the issue strikes me. – mostlyinformed Nov 5 '15 at 0:49
1

I don't really see why this wouldn't work. You would have for instance:

  • An accounting folder that only accountants can access.
  • A Human Resources folder that only HR can access.
  • A folder everyone can read with eg. the internal documentation for configuring Outlook.

You only need to organize the content tree in a logical way and then assign permissions as needed (note that you can give permissions per folder and even per file, it doesn't need to be per-share¹).

Why would someone in HR save a CV alongside Outlook help file?

Maybe you were thinking in an approach with the folders encoding target permissions, an extreme example of which could be folders named by the people accessing there. Not only would this be complex for the users (why should I need to remember everyone on department X?) but also confusing should someone change departments.

You shouldn't make people think on "Who should be given access to this" but "Where should this be filled?".

As far as I know, this is how most companies work.

¹ You're not still using Windows 95-Millenium, are you? ;)

  • Hey, I was on the Win95 team :) But no, we're mostly on Windows 7 with a few brave souls on WIndows 8 or 10. – David Thielen Nov 4 '15 at 23:04
  • Actually, I think he's exactly right to think "Who are the specific people who actually need access to these sensitive documents?" The fewer people who have access to sensitive info, the better. – mostlyinformed Nov 5 '15 at 0:54
  • Though, yeah, maybe I'd store & name the folders & in a way that's depends on role/job of person who needs access, rather than as "John Smith's accessible HR documents" or something. Good point. – mostlyinformed Nov 5 '15 at 2:07
1

Hmmm. I think I might be inclined to go with a slightly different approach than integrating authentication to access your sensitive documents store with your Active Directory setup. Because, in my view, then the security of those documents would then become almost solely dependent on the security of your AD setup. And that might not necessarily be a good thing, security-wise.

It's not that Active Directory is impossible to implement in ways that assure robust security for especially sensitive stuff; obviously, a lot of shops manage to do just that. However, a lot of shops also think they can do so and wind up failing in the effort. (Some of them get breached and have these flaws vividly exposed, some just get lucky and never get attacked in any concerted way.)

The people who implement and run your AD setup may be good, but creating and continuously maintaining a domain environment with robust security is a really challenging thing. Can you say you're certain that your people or contractors are well-versed enough in infosec admin practices to compartmentalize their domain admin activities so as not to expose their domain admin credentials (ie. "the keys to an Active Directory kingdom")? To setup two-factor authentication--which you really, really want when protecting especially sensitive information of any kind-- with your current AD setup? I don't mean to prejudge the capabilities of the people who handle your tech setup day-to-day right now, but... well, in my experience small-to-small-midsize shops like yours usually don't have highly-qualified, security-savvy administrators in-house to properly manage AD in a high-security environment. And if you link your documents store to AD authentication your whole AD setup will need to be run as a heightened-security environment. Which is often not desirable.

There is one much simpler, arguably more secure approach which comes to mind but might or might not be appropriate depending on exactly how sensitive the info in those documents is: setting up an Office 365 account and storing your documents there with two-factor authentication enabled. I know one tends to hear about a cloud option for storing sensitive stuff and wince (I usually do the same), but in your case it might actually be a more secure alternative. One of your threat vectors, physical theft of the drives containing the info, is dealt with nicely by going-off premises, and two-factor auth run by Microsoft does not make the security of your documents dependent on your local AD domain being configured and maintained properly 100% of the time by your people or contractors. Also, you can set folder-by-folder access permissions for different users even more easily than your can with local folders & shares.

(Side note: Just to be clear I'm not shilling for Microsoft's cloud solution. Google's wares would also meet the OP's needs, as could those of Dropbox, or box.net, or etc. Office 365 just came to mind first because the OP has a Microsoft shop, and because that's where my personal skills and experience also largely lie as well.)

  • Might be a better answer if you shrink the first paragraph some. That seems not critical to your (IMO rather good) solution. – Neil Smithline Nov 5 '15 at 5:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.