Risk
10/5/2011
08:55 AM
Connect Directly
RSS
E-Mail
50%
50%

6 SharePoint Security Challenges

Even Microsoft recommends locking down its popular and widely used collaboration, file sharing, and online publishing platform.

Top 20 Top Add-Ons For Microsoft SharePoint
(click image for larger view)
Top 20 Top Add-Ons For Microsoft SharePoint
How many businesses consider security when implementing Microsoft SharePoint?

The question is pertinent because the collaboration, file-sharing, and website-building platform is widely used. According to 2009 sales figures, SharePoint already had more than 100 million licensed users and generated $1.3 billion in revenues per year. While Microsoft has yet to update those figures, earlier this year it claimed to be adding 20,000 new SharePoint users per day.

Those are a lot of SharePoint installations to secure. Here's where to start:

1. Discover SharePoint. As with any popular product--especially one that involves collaboration--individual business departments may implement SharePoint without going through IT channels. "SharePoint is very easy to set up and use, so a lot of organizations find very organic growth of SharePoint inside their organization," said Raphael Reich, director of product marketing at security firm Imperva. Uncontrolled growth increases the risk that not every SharePoint installation has been properly secured, or kept updated via the business's patch management program.

[ Considering social software? Read Forrester Names 4 Leading Enterprise Social Platforms ]

2. Identify Exposure. As bespeaks SharePoint's range of capabilities--from collaboration to website and extranet creation--the SharePoint application platform ships with well-known ports, protocols, and services active by default. No wonder that Microsoft recommends hardening out-of-the-box SharePoint implementations to reduce the potential for attack.

3. Secure Databases. Start the security exercise by locking down the databases that power SharePoint. "When securing data in SharePoint, another facet is that ... you're dealing with files. But they're really stored in a Microsoft SQL database, and there are no inherent protections for that database," said Reich. Likewise, such databases don't feature audit trails, which are a must when storing regulated data.

4. Spot Web Applications. Hackers' favorite online attack vector is the Web application. SharePoint, meanwhile, is used by many businesses to build websites and custom Web applications. Ergo, SharePoint websites and extranet portals, especially, are at risk of online attack and must be secured appropriately. "SharePoint, as a Web-facing application, would be subject to SQL injection, cross-site scripting, or any potential attack against a website," said Reich. Consider Web application firewalls and virtual patching.

5. Trace Access. Controlling access to files is hard enough. How do you handle access to unstructured data? "From a security standpoint, SharePoint is in some ways very similar to Microsoft file servers," said Reich. "One of the challenges with securing files is just the ACL--access control list--for files is kind of unwieldy," said Reich. "There's a lot of permissions chaos, right at the level of these files." Businesses typically attempt to marry Active Directory groups with file-level access permissions, but these need to be managed, as they may easily allow employees to access too much--or even too little--sensitive data.

6. Block The Bugs. Do hackers favor SharePoint over, say, WordPress or Lotus Notes? In fact, a better question is: If someone wanted to break into SharePoint and steal sensitive information, how would they go about it? "I went into a couple of hacker forums recently to see what they think about SharePoint, and ultimately the question is, if a website is built on SharePoint, they need to know a couple of vulnerabilities about SharePoint," said Rob Rachwald, director of security strategy at Imperva, in an interview.

In other words, where SharePoint is concerned, don't forget to test, harden, manage, audit, and regularly update it. Because even for an unstructured-data platform with collaboration capabilities, security rules still apply.

In "Becoming A Security Detective," this all-day virtual event from InformationWeek and Dark Reading, experts will offer detailed insight in how to collect security intelligence in the enterprise, and how to analyze and study it in order to efficiently identify new threats as well as low-and-slow attacks such as advanced persistent threats. It happens Oct. 20. Sign up now. (Free with registration.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3541
Published: 2014-07-29
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

CVE-2014-3542
Published: 2014-07-29
mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) is...

CVE-2014-3543
Published: 2014-07-29
mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity referenc...

CVE-2014-3544
Published: 2014-07-29
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.

CVE-2014-3545
Published: 2014-07-29
Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.