This question is a bit broad, but I'm hoping someone can point me in the right direction. I administer a small LAN at work with 15-20 machines on it. They are running Windows XP - Windows 8 and I have a Linux based NAS for backups attached as well.

In the past, every user was highly trusted and my main concern was making sure files were easily accessible. I did things like grant "Everyone" full permissions on the root of each drive. Now, we are bringing on some semi-trusted personnel that I don't want to have access to "everything" on every computer in the network. So the questions are:

  • How can I effectively restrict access to certain areas?
  • How can I allow the trusted users to still easily access restricted content?
  • How can I secure the Linux backup?
  • How can I protect the network against disgruntled employees who may still have access?

I've tried some Googling, but I'm finding information mostly about protecting against external threats. Any pointers are greatly appreciated. Thanks.

Update: My first step has been to remove the "Everone" group from the NTFS permissions for sensitive files. This effectively protects them from access, but it is also a pain. I would like to be able to authenticate (via a password maybe) to gain access if needed. I've come across Windows Active Directory which might be what I'm looking for, but it looks like a beast to try to learn and implement. Am I barking up the wrong tree here?

closed as off-topic by Eric G, Xander, TildalWave, Adi, AJ Henderson Apr 24 '14 at 13:43

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This is an operational question better fit for Server Fault or Super User – Eric G Apr 23 '14 at 22:24
  • Hmm, normally when I post security related questions on other SE sites people refer me here. Feel free to migrate it though if it doesn't belongs here. Thanks. – Dominic P Apr 23 '14 at 23:21

AD is the ultimate place to go, so don't overlook it, but it may be overkill for your environment.

Quick and dirty response:

Look at classifying your data, assigning owners of the data (Data Owners), and assign permissions to assets (files, devices, etc.) based on roles (Finance, Finance Managers, IT, IT Managers, Sales, Sales Managers, etc.). Who maintains the list of users who belong to each group as the people change is up to your specific organization (central authority or each Data Owner).

As for disgruntled employees who are no longer with the company, make sure that you revoke access ASAP. If they are still with the company, then you need to have good backups...

Backup devices should be encrypted with the key properly secured. Store backup media offsite and have a process by which you validate backups (regular test restores) and that you destroy data that is no longer needed. (Data owners define when data needs to be destroyed or retained).

  • Thanks for the helpful response. I'll learn more about AD. Regarding setting up owners and groups, should that be done at the NTFS level or the Samba level? Neither would allow a user to authenticate with a password to access files, correct? Sorry again for the basic level questions. I'm still pretty new to this. – Dominic P Apr 23 '14 at 23:25
  • It looks like you are caught between the 'theory' and 'practice' forums. I can give general guidance here but for specific implementation, you'll need to consult the appropriate forum (Serverfault) – schroeder Apr 24 '14 at 14:39
  • I appreciate the help none the less. Maybe I'll post an implementation related question on Serverfault once I learn a bit more. Thanks. – Dominic P Apr 24 '14 at 18:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.