Threat Modeling a SharePoint Application: An exploratory exercise in preventing data breaches and theft.

Transcription

1 Threat Modeling a SharePoint Application: An exploratory exercise in preventing data breaches and theft. By Tony Graves SharePoint Developer and Consultant February Threat modeling is about using models to find security problems. Using a model means abstracting away a lot of details to provide a look at a bigger picture, rather than the code itself. You model because it enables you to find issues in things you haven t built yet, and because it enables you to catch a problem before it starts. Threat Modeling can be applied to software you re building or deploying, or software you re considering acquiring. Building a SharePoint Solution or website is no different. Here is a brief guide on how to build a minimum threshold for your organization in a SharePoint environment. Threat Modeling in SharePoint 2013 Not all content holds the same value for an organization. Some content is transitory and will only provide value for a short time, while other content serves as official records, preserving evidence for a transaction or decision making tool such as ediscovery. Some Guidelines to start: Determine the value of an asset to protect. Consider the risk and probability of unintentional information disclosure. Calculate the costs associated with unintentional information disclosure. Evaluate the exposure and attractiveness of the asset to an adversary. Estimate the discoverability of an exploit or the asset s existence. Analyzing Your Information Security Requirements Decide what information consists of a secret and what you can make available for general knowledge. Too much security, where everyone locks down their content to a limited audience, only leads to information silos. The risk here, of course, is that other knowledge workers will not be able to discover and benefit from the knowledge contained in a limited workgroup.

2 Part B: Strategies for Securing SharePoint Permissions. To start, creating a great content inventory, will give you a sense of what kinds of content the different sites store you have on your farm. This can help you determine how secure or how open the content should be. You can also use content classifications to guide decisions about the appropriate level of security based on an organization-wide classification scheme such as Sensitivity or Security Level. Some Farm Security Strategies 1. Disable unnecessary services 2.Do not install extraneous software or components 3.Block unused ports 4.Deploying firewalls and proxy servers to segregate the SharePoint database servers Strategy 1: Configuring SharePoint Groups and Permissions You can grant permissions to a SharePoint group and add the user to that group, or you can grant the permissions directly to the user in a site. I prefer to add users to SharePoint groups and only assign permissions to the group because this makes it easier to update and manage any permissions in the future. By default, a SharePoint site is created with three SharePoint groups: site owners site members, site visitors. You can add user accounts directly to these groups and the accounts will be granted the permissions applied to the group. Alternatively, you can add an Active Directory security group to the SharePoint group membership if you prefer to manage group membership through Active Directory. The default SharePoint site groups hold the following permissions: Site Owners: Group members are granted full control over the site, including granting permissions to other users. Site Members: Group members are granted contributor access to the site, where they can add, edit, and delete items in lists and libraries. Site Visitors: Group members are granted read access to the site.

3 Tip: It is always better to create a custom permission level rather than edit an existing permission level. Users will expect the default permission levels to behave a certain way. As such, users will not anticipate you changing the individual permission rights for one of those default permission levels, an unexpected change that could then cause a security or usability issue. Strategy 2: Configuring Web Application User Policies You may also wish to deny certain permission rights for users or groups and apply this restriction globally on a web application. You can set this using a user policy as well. To apply a user policy to a web application, follow these steps: 1. Navigate to the SharePoint Central Administration and click Manage Web Applications. 2. On the Manage Web Applications, select the web application for which you wish to apply a user policy. 3. Click the User Policy button in the ribbon. 4. On the Policy for Web Application page, click the Add Users button. 5. If desired, specify a zone for the user policy. Click Next. 6. On the Add Users page, specify the users and choose the permissions to grant or deny. Click Finish. By default, SharePoint offers four Permission Policy Levels: Full Control: Has full control Full Read: Has full read-only access Deny Write: Has no write access Deny All: Has no access Strategy 3: Configuring Special Combination of Permission Rights You may have requirements that need a special combination of permission rights to grant or deny to users on an entire web application. To create a custom permission policy, follow these steps: 1. Navigate to the Manage Web Applications page in SharePoint Central Administration. 2. Select the desired web application and click the Permission Policy button in the ribbon. 3. Click the Add Permission Policy Level button on the Manage Permission Policy levels page. 4. Specify the desired settings on the Add Permission Policy Level page. Click Save.

4 Strategy 4: Understanding Rights Management Service (RMS An Access Control List (ACL) stores the permission entries that determine which users can access a resource and what actions they can take on the shared copy. However, once a user executes his or her permission to access and download a piece of content, the access controls no longer enforce any restrictions on the content. One security risk with this security model is when a user downloads a file and then forwards it to another user who may not have permission granted to the original location. The risk for this type of accidental or intentional disclosure of sensitive information drives the need for security that can protect a secret contained in a document beyond the initial access. Rights Management Service (RMS) mitigates this risk by providing an extra layer of security for a document using encryption technology. RMS encrypts a document, leaving it in an unreadable state. When a user accesses a rights managed document, the Rights Management Service s client component contacts the Rights Management Service to identify what rights to grant the user. There are several reasons you might want to protect content with the added layer of Rights Management Service including: Enforce a limited audience for a piece of content. Expire a piece of content after a specific duration. Prevent printing, copying, and taking screenshots of a piece of content The different scenarios you can implement using the Rights Management Service stem from different combinations of permission rights settings. You can grant or restrict the following permission rights for a piece of content: Full Control: Grants users every right listed, plus the right to change permission rights for the protected content. View: Allows users to open and read the protected content. Edit: Allows users to edit and change the protected content. Save: Allows users to save a protected file. Extract: Allows users to make a copy of any part of the protected content and paste it into another application. Export: Allows users to save the protected content in another file format using the Save As command. Print: Allows users to print the protected content. Allow Macros: Allows users to run macros against the protected content. Forward: Allows recipients to forward a protected message and to add or remove recipients. Reply: Allows recipients to reply to the sender of a protected message. Reply All: Allows recipients to reply to all recipients of a protected message.

5 View Rights: Allows users to view the permission rights associated with the protected content. Strategy 5: Configuring RMS in SharePoint SharePoint is aware of the Rights Management Service and detects protected content when a user saves it to a library. Before saving a protected document, SharePoint will access the Rights Management Service and decrypt the document; it will then encrypt the content again before streaming any downloads to users. The reason it stores content without the Rights Management encryption applied is to optimize the search indexing process, otherwise the index crawler would have to decrypt each document every time it crawled content in a SharePoint farm. To enable SharePoint to work with the Rights Management Service, navigate to SharePoint Central Administration and configure the settings in the following steps. 1. Click the Security link in the left navigation menu to navigate to the Security page. 2. Click the Configure Information Rights Management link in the Information Policy section to navigate to the Information Rights Management page. 3. On Information Rights Management page, select to use the default RMS server, alternatively, you can specify a RMS server. Click OK. Strategy 6: Security Trimming Security trimming is a function in SharePoint which filters out search results in a way that restricts a user from viewing results they are not supposed to see which improves the user experience, because users do not want to click on a result that interests them, only to discover they do not have permission to view it. Just by the nature of search results revealing content not intended for that audience, Security trimming provides a result set that limits exposure to that content. SharePoint uses the access control list (ACL) associated with each document to trim out query results that users have no permission to view, but the default trimming provided by SharePoint (out-of-box trimming) may not always be adequate to meet data security needs. In that case, you may want to further trim the results depending on an organization s authentication structure. To find out more about Security Trimming visit:

6 References: 1. Steve Goodyear, SharePoint 2013 Enterprise Content Management; Hands on Guidance to Design and Implement your Information Life Cycle Strategy. 2. Adam Shostack, Threat Modeling, Designing for Security