About Chris Welch Synergy – Global Reach. Local Service. - Cell Online - USA | South Africa | United Kingdom | Asia Pacific

SharePoint 2010 End User Security - Standardization and Customization Understanding security in the End User environment Discussion and Demonstrations All participation is welcome and appreciated

SharePoint 2010 End User Security - Standardization and Customization > Planning and understanding < How do you make a meaningful security infrastructure? So… Let’s talk a bit about security

What is security? Trust Trust in people Trust in technology Trust in business P&P Trust in the institutional setting

Best Practice Keep it simple Reduce Reuse Recycle Security is a management process

Basic Security Concepts Plan the security environment Plan the security environment What – define security What – define security Sites Sites Lists and libraries Lists and libraries Who – define roles Who – define roles Separation of Duties Separation of Duties Access – define levels Access – define levels Least Privilege Least Privilege

SharePoint Roles Standard Security Roles Standard Security Roles Farm Administrator Farm Administrator Site Collection Administrator Site Collection Administrator Service Application Administrator Service Application Administrator Site Administrator Site Administrator Users Users

Security Terms Authorization vs. Authentication Authorization vs. Authentication Risk Management Risk Management $ or other measure $ or other measure Central tenets of measuring secure systems Central tenets of measuring secure systems Confidentiality Confidentiality Integrity Integrity Availability Availability Non Repudiation Non Repudiation Others…. Others….

So What About SharePoint? Demo Interlude Demo Interlude How does SharePoint do - How does SharePoint do - Confidentiality Confidentiality Integrity Integrity Availability Availability Non-Repudiation Non-Repudiation

Discussion Point Where are the Where are the Strengths in your SharePoint security Strengths in your SharePoint security Weaknesses in your SharePoint security Weaknesses in your SharePoint security What is the trust factor

Architecture Primer SharePoint architecture SharePoint architecture Web Application Site Collection Sites Lists and Libraries

Web Application Security Performed by a Farm Administrator Performed by a Farm Administrator Security Security Authentication Authentication User Permissions User Permissions Policies Policies Anonymous Anonymous User User Permissions Permissions

Web Application Demo Authentication Providers Authentication Providers User Permissions User Permissions Remove Manage Lists permission Remove Manage Lists permission Policies Policies Create Deny Delete Permission Policy Create Deny Delete Permission Policy Apply as a User Policy Apply as a User Policy

Site Collection Administrator Site Collection Administrator Has full control of all content in a site collection Has full control of all content in a site collection Is bound by security policy settings at the Web Application level Is bound by security policy settings at the Web Application level Is managed at the site collection or farm Web Application level Is managed at the site collection or farm Web Application level Highly trusted position in user environment Highly trusted position in user environment Farm Administrator Farm Administrator Site collection security

Site Level Security Uses three basic pieces of infrastructure Uses three basic pieces of infrastructure Security principle Security principle Securable Object Securable Object Permission Level Permission Level User or GroupSite-List-Item Permission Level

Users and Groups Maintained at the site collection Maintained at the site collection Users Users Available from Authentication Provider Available from Authentication Provider Stored in user information list Stored in user information list Groups Groups AD AD SharePoint SharePoint Best Practice Discussion Best Practice Discussion Users vs. Groups Users vs. Groups

Some Limits to Consider Supported Limits Supported Limits Groups per users Groups per users Users – 2 million per SC Users – 2 million per SC Principles per group – 5000 Principles per group – 5000 SharePoint Groups – 10,000 per SC SharePoint Groups – 10,000 per SC Security Scope – 5000 Security Scope – 5000 Limits based on performance Limits based on performance

Users and Group Demo Users and Group Users and Group Review groups Review groups Create a group and discuss settings Create a group and discuss settings Suggestions Group Suggestions Group Add users Add users Settings overview Settings overview Groups page Groups page Group Group

Securable Objects Sites, lists and libraries, item Sites, lists and libraries, item Security inherited by default Security inherited by default Inheritance can be removed Inheritance can be removed Sites can be created with unique permissions Sites can be created with unique permissions Creates three groups by default Creates three groups by default Permsetup.aspx Permsetup.aspx

Securable Objects Demonstration Review settings Review settings Remove inheritance for a site Remove inheritance for a site Remove inherited principles Remove inherited principles Create a new security infrastructure Create a new security infrastructure

Permissions and Permission Levels Used to grant access Used to grant access Based upon granular permissions Based upon granular permissions Default set of permission levels Default set of permission levels FDCRL FDCRL AMRV AMRV Do not delete! Do not delete! Used to create customized security settings Used to create customized security settings

Permission Levels Stored at the top level site Stored at the top level site Inheritance can be broken, using PowerShell Inheritance can be broken, using PowerShell Best practice is to create a new Permission Level by inheriting from an existing one Best practice is to create a new Permission Level by inheriting from an existing one

Demo of Permission Levels Review permissions Review permissions Create a permission level by copying Create a permission level by copying Remove delete versions Remove delete versions Create a manage lists permission level Create a manage lists permission level Demonstrate permission dependencies Demonstrate permission dependencies

Finally Security Security Standardize where possible Standardize where possible Customize where necessary Customize where necessary Plan Plan Document Document Simplify Simplify

Questions?