Please provide two pages answer for 1, 2, 3 and 4 questions each:

1. Summary of available technologies that address the potential security threats and risks identified for the Sharepoint.

Security Threats to Sharepoint:

Permission Slipups:

Sharepoint control list is similar to windows. Administrators are defined using groups and manually provide permissions. What makes native permissions challenging however is a sharepoint lacks an automated way to ensure that rights remain aligned with business needs as raw and structure data is added to Sharepoint additional permissions are created either t hrough inheritance or assignment and must be managed without a centralized view of permissions for users across sites tracking and managing all of the permissions increases complexity. Further access needs and restriction change as users start new work projects, change job roles or leave the company.

Failure to comply with mandates and governance

Sharepoint building capabilities for access activity auditing and reporting are limited. This screenshot shows an example of the build in audit trail as you can see it does not provide readily usable information for example look at the site Id and the item Id columns.

They contain long string of numbers that must be decoded to provide meaningful information not only in the audit trail unreadable but a malicious administrator may be able to modify or delete native logs. Also sharepoint doesnt have forensic capabilities if a breach occurs either from an insider or a hacker. Share point does not provide a way for Organization to know what happened.

Website Vulnerabilties:

Sharepoint deployments include portals for customers partners or the public and can even be used as the Organizations website infrastructure. As such all the same issues you have with a web application you have with share point typical problems include SQL injection, cross password attack and cross site scripting with todays automated attack tools. No one will be spared including the Sharepoint deployments.

Direct Access to the Backend Database :

Because of sharepoint reliance in SQL server storage protection is essentially database protection administrators and priviledged users can perform any direct modification of the database leaving the in an unsupported in other cases privilege users can simply read the entire database and use the copy to access all the information on SharePoint. This bypasses Share Points permissions and native audit mechanism.

Exposure to Search Engine:

Search engine constantly crawl and update their indexing policies so that breaches or misconfigured entry points are quickly apparent to all. For instance in October 2010, the Missipi national guard notified that it accidentally exposed personal information of nearly 3,000 soilders under external Microsoft Shrepoint website. There are even different google hacking tools which specifically search for sharepoint data exposure. One such tools is Sharepoint hacking diggity project.

The security threats identified are -

1.Failure to secure sharepoint against priviledge insider accounts Limit priviledge levels for administrator accounts and deploy third party security solutions that enable encryption and access control.

2.Inadequate or Non-existent audit trails for sharepoint usage and administrative access Enable auditing for system and file access, and for all administrative charges to sharepoint.

3. Failure to limit administrator and service accounts Limits privilege on service accounts, disable the install account and dont use shared administrator accounts.

4. Sharepoint system architecture and network configuration issues Put a dedicated sharepoint web front end in DM2, use a single person per server approach, and harden the sharepoint, OS and database according to best practices.

5.Failure to perform backups and provide DR capabilities Perform backups and test and restore them on a regular basis, atleast manually. Then consider how to recover from disasters using sharepoint services.

--------

2. Summary of suggested policies or practices that can be implemented to mitigate the security threats or risks identified

--------

3. Implications for the reliability, accuracy and integrity of information processed within the system suggested

-------

4. Recommendations on an approach to security the organization should adopt using some or all of the technologies, policies or practices discuss