Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10 SharePoint Security Mistakes You Probably Make

Bradley Manning allegedly stole sensitive government cables destined for WikiLeaks from a SharePoint server. Are your information security controls tighter than the Army's were?

Top 20 Top Add-Ons For Microsoft SharePoint
(click image for larger view)
Top 20 Top Add-Ons For Microsoft SharePoint
How important is it to secure and monitor Microsoft SharePoint?

Consider the case of Bradley Manning, the Army intelligence analyst who's accused of leaking 250,000 government cables to WikiLeaks. According to an Army investigator who testified at a hearing to determine if Manning should face a court martial, one of Manning's laptops contained an Excel spreadsheet, containing a tab with multiple Wget scripts--designed to download large numbers of files--that "pointed to a Microsoft SharePoint server" that stored documents for the Guantanamo Bay Naval Base detention facility, reported Wired. The investigator further testified that "he ran the scripts to download the documents, then downloaded the ones that WikiLeaks had published and found they were the same."

In other words, the release of sensitive government cables may have been partially prevented, had the military better secured and monitored its SharePoint servers.

Similarly, any business that relies on SharePoint to store confidential--or even sensitive--information should know who's accessing that data, and why. What's the best way to make this happen? Start by avoiding these 10 stupid, but common, SharePoint security mistakes.

[ Check out other tips for optimizing your SharePoint performance. See 5 SharePoint Pitfalls To Avoid. ]

1. Poor security training. According to a survey of 100 SharePoint users conducted by security vendor Cryptzone at a November 2011 SharePoint Saturday conference, 92% agreed that removing information from SharePoint made it less secure, but 30% were willing to take that risk "if it helps me get the job done." Obviously, there's a disconnect at many businesses between security and productivity. Worryingly, 34% of respondents also said they'd never even considered the security implications surrounding SharePoint.

2. Collaboration barriers. Likewise, the survey found that 45% of users regularly copied sensitive or confidential data from SharePoint to their hard drive, to a USB drive, or to email it to someone else. In the majority of cases (55%), this copying was to facilitate information-sharing with someone who lacked access to the SharePoint documents. This highlights the need for businesses to put clear policies in place regarding how information can be shared, and then to monitor access and enforce policy compliance.

3. Unclear security oversight. Who's responsible for SharePoint security? At 69% of businesses, the Cryptzone survey found that access management responsibility fell to in-house IT administrators. But 22% of respondents--which included SharePoint users, administrators, developers, and architects--didn't know who was responsible, which suggests that there's a lack of oversight and thus access accountability at their businesses.

4. Overly broad access rights. When it comes to access, less is typically more. "One of the most common issues we see with SharePoint is end users having access privileges that are far too broad," said Enterprise Management Associates (EMA) senior analyst Torsten Volk, via email. "It's a lot of work to properly create user roles and map them to Active Directory," and even more work to keep them updated, revised, and removed after employees depart. According to Scott Crawford, managing research director at EMA, this challenge "has given rise to vendors such as Aveksa, Varonis, and others" to analyze usage patterns and determine likely data custodians.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HemantK860
50%
50%
HemantK860,
User Rank: Apprentice
10/29/2013 | 11:19:42 AM
re: 10 SharePoint Security Mistakes You Probably Make
Few Questions to be answered before you start a SharePoint project:

http://sharepoint.asia/few-que...

You are requested to add more here as comments based on what you had to go through in your previous projects .
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9417
PUBLISHED: 2020-10-20
The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction...
CVE-2020-15264
PUBLISHED: 2020-10-20
The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking ...
CVE-2020-15269
PUBLISHED: 2020-10-20
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
CVE-2019-9080
PUBLISHED: 2020-10-20
DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
CVE-2020-15931
PUBLISHED: 2020-10-20
Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a ...