Common Security Mistakes Security Awareness Incident Response Poor Password Management Bad administrative practices Over-privileged Users Unused Services Unsecured Servers Mis-configured Edge Devices Poor Auditing/Logging Practices Poor Data Access Control

Internal Users External Users SharePoint Server Anonymous

Windows Authentication Anonymous Access Access to users without server accounts Enabled in IIS Disabled in SharePoint 2007 Windows Authentication Pluggable authentication Independent identity Custom code ASP .NET Authentication Pluggable authentication Independent identity Custom code

Administrator: Full Control over logs Ability to restore from backup Administrator: Full Control over data Full Control over logs Ability to restore from backup Busy Content Owner: Full Control over data Responsible for data Ability to restore from Recycle Bin Content Owner: Responsible for data

Second-level Recycle Bin Site Collection Administrators Central Administrators Default full access Fix lockouts Second-level Recycle Bin Grant self-access Logged-on Event Log Unremoveable permissions

Owners Visitors Members Full control access Visitors Read-only access Members Lists and libraries

Permission Levels Full Control Design Contribute Read Fine Grained Owners Full Control Design Contribute Read Fine Grained Visitors Members

Author defines permissions to file. Recipient Author defines permissions to file. Document is encrypted with symmetric key. RMS server encrypts the file with a public key and adds it to publishing license. Author distributes the file. Recipient opens a protected file RMS server validates permission and issues license to decrypt the file. File is opened. Recipient is limited to tasks defined by permissions Windows Server 2003 with RMS Database Server Active Directory Server

User Downloads Document Role Matched to Library License to Decrypt Issued Permissions Granted

SQL Server 2005 Security Windows Server SQL Server Database Monitoring Domain Policies SQL Server Connections Logins Database Schema Catalog Monitoring Triggers Notification SQL Server 2005 Security

Schema Object Permissions

ALTER ANY LINKED SERVER Object SELECT Database CREATE TABLE Schema ALTER

Secure by default Surface Area Configuration Encryption HTTP Endpoints

Services and features off by default Local connections only SAC to enable services / features Windows Server 2003 SQL Server 2005 Upgrade preserves settings Other services / features disabled SAC to enable services / features Windows Server 2003 SQL Server 2000 SQL Server 2005

“An Endpoint is a point of entry into SQL Server” Shared Memory Named Pipes TCP Virtual Interface Adapter HTTP (Windows 2003 Only) HTTP Transport is not created by default HTTP Endpoints support 4 authentication types for web methods Anonymous access is not allowed Communications can be secured with SSL

Single shared key Very fast Not for module signing Symmetric Individual keys Slower than symmetric Used for module signing Asymmetric Includes Certificate Authority Validates encryption keys Used for module signing Certificate

Login and DDL Triggers Eventdata Function Login triggers fire after login DDL triggers fire on alteration Server or database level Logging and auditing Login and DDL Triggers What fired a trigger Type, SPID, User, Time, Code Returns XML data Eventdata Function

Re-think content ownership and permissions Understand changes in SharePoint data access Inventory applications using a database Secure connectivity to servers Virtual machines need the same attention

Daily Bi-Weekly Monthly 1. IT Pro Blogs http://blogs.technet.com/canitpro/ Bi-Weekly 2. TechNet Flash Newsletter microsoft.ca/technet/tnflash/default.aspx Monthly 3. TechNet Security Newsletter microsoft.ca/technet/securitynewsletter

Q & A