2. Common Security Mistakes
Security Awareness
Incident Response
Poor Password Management
Bad administrative practices
Over-privileged Users
Unused Services
Unsecured Servers
Mis-configured Edge Devices
Poor Auditing/Logging Practices
Poor Data Access Control

3. Internal Users
External Users
SharePoint Server
Anonymous

4. Windows Authentication
Anonymous Access
Access to users without server accounts
Enabled in IIS
Disabled in SharePoint 2007
Windows Authentication
Pluggable authentication
Independent identity
Custom code
ASP .NET Authentication
Pluggable authentication
Independent identity
Custom code

5. Administrator:
Full Control over logs
Ability to restore from backup
Administrator:
Full Control over data
Full Control over logs
Ability to restore from backup
Busy
Content Owner:
Full Control over data
Responsible for data
Ability to restore from Recycle Bin
Content Owner:
Responsible for data

6. Second-level Recycle Bin
Site Collection
Administrators
Central
Administrators
Default full access
Fix lockouts
Second-level Recycle Bin
Grant self-access
Logged-on
Event Log
Unremoveable
permissions

7. Owners Visitors Members
Full control access
Visitors
Read-only access
Members
Lists and libraries

8. Permission Levels Full Control Design Contribute Read Fine Grained
Owners
Full Control
Design
Contribute
Read
Fine Grained
Visitors
Members

9. Author defines permissions to file.
Recipient
Author defines permissions to file.
Document is encrypted with symmetric key.
RMS server encrypts the file with a public key and adds it to publishing license.
Author distributes the file.
Recipient opens a protected file
RMS server validates permission and issues license to decrypt the file.
File is opened.
Recipient is limited to tasks defined by permissions
Windows Server 2003 with RMS
Database Server
Active Directory Server

10. User Downloads Document
Role Matched to Library
License to Decrypt Issued
Permissions Granted

12. SQL Server 2005 Security Windows Server SQL Server Database Monitoring
Domain
Policies
SQL Server
Connections
Logins
Database
Schema
Catalog
Monitoring
Triggers
Notification
SQL Server 2005 Security

13. Schema
Object
Permissions

14. ALTER ANY LINKED SERVER
Object
SELECT
Database
CREATE TABLE
Schema
ALTER

15. Secure by default
Surface Area Configuration
Encryption
HTTP Endpoints

16. Services and features off by default Local connections only
SAC to enable services / features
Windows Server 2003
SQL Server 2005
Upgrade preserves settings
Other services / features disabled
SAC to enable services / features
Windows Server 2003
SQL Server 2000
SQL Server 2005

17. “An Endpoint is a point of entry into SQL Server”
Shared Memory
Named Pipes
TCP
Virtual Interface Adapter
HTTP (Windows 2003 Only)
HTTP Transport is not created by default
HTTP Endpoints support 4 authentication types for web methods
Anonymous access is not allowed
Communications can be secured with SSL

18. Single shared key
Very fast
Not for module signing
Symmetric
Individual keys
Slower than symmetric
Used for module signing
Asymmetric
Includes Certificate Authority
Validates encryption keys
Used for module signing
Certificate

19. Login and DDL Triggers Eventdata Function
Login triggers fire after login
DDL triggers fire on alteration
Server or database level
Logging and auditing
Login and
DDL
Triggers
What fired a trigger
Type, SPID, User, Time, Code
Returns XML data
Eventdata Function

20. Re-think content ownership and permissions
Understand changes in SharePoint data access
Inventory applications using a database
Secure connectivity to servers
Virtual machines need the same attention

21. Daily Bi-Weekly Monthly
1. IT Pro Blogs
Bi-Weekly
2. TechNet Flash Newsletter
microsoft.ca/technet/tnflash/default.aspx
Monthly
3. TechNet Security Newsletter microsoft.ca/technet/securitynewsletter

22. Q & A