Writing under the nom de plume of Mathais Thurman, in his “Security Manager’s Journal,” Marthais opined on “The perils of enterprise search”. Mathais’s take away comment is “First and foremost, you have to make sure you don’t compromise the rule of least privilege.”
To those of you not that might not know, the rule or principle of least privilege is:
“The principle of least privilege (POLP) is the practice of limiting access to the minimal level that will allow normal functioning. Applied to employees, the principle of least privilege translates to giving people the lowest level of user rights that they can have and still do their jobs. The principle is also applied to things other than people, including programs and processes.” From http://searchsecurity.techtarget.com/definition/principle-of-least-privilege-POLP.
So how are POLP and enterprise search intertwined? One of the key goals of an enterprise search deployment is to index content from various enterprise repositories such as SharePoint sites, web sites, Exchange servers, file shares, and many others. If you do not take into account the security access rights of the various repositories, you might be surprised at what can be found using search. This was illustrated to me on one of my first customer proof of concept (POC) engagements. We were asked to index some content on a few internal file shares as well as their public Exchange folders. The security aspects of search were not being evaluated at this time. After a few days of work I was finished and went to our sponsor to show her the results. I showed her the search interface, along with some of the advanced search features on the results page; I then let her use the software on her own. In about a half hour she called me into her office. I knew something was wrong by the flustered look on her face. One of her searches had turned up a highly confidential document. Evidently the security of its repository was not set appropriately, this lead to a search security discussion, and a meeting with their IT security lead.
The bundled SharePoint search, Fast Search for SharePoint, and Fast Search for Internet Sites all support the policy of least privilege, i.e. the user is restricted to seeing only content they are authorized to view. This is accomplished by the use of access control lists and results trimming as well as the capability to extend the security model using the custom security-trimming infrastructure. SharePoint 2010 has added Claims based authentication, and enhanced the document level security while the content is in the SharePoint repository. To secure your content as it leaves the SharePoint site, consider using Information Rights Management (IRM). IRM can be configured at the document library level, so when content is checked into the SharePoint library, it is wrapped in an IRM security blanket. As Arpan Shah points out, “By applying the wrapper at download time & leveraging SharePoint security while the content lives in SharePoint, the search indexer is able to effectively index the content - which is a great feature. “
For a more complete discussion of SharePoint search security, I highly recommend you read “Trim SharePoint Search Results for Better Security” by Ashley Elenjickal and Pooja Harjani.
We look forward to your comments. If you have a technical tip you would like to share with your colleagues, send it to firstname.lastname@example.org to be included in our next Technical Tips blog. See you in class!
By: Philip E. Helsel
With its rich series of classroom and online courses, FAST University provides you with an insider’s knowledge of FAST search technology, methodologies, and best practices so you can make the most of your deployments and improve your search experiences quickly and continually. The classroom instruction is tailored to your needs and can be delivered at your location or ours.
Stay ahead of the pack! Learn how to harness the power of the latest version of Microsoft FAST Search Server 2010 for SharePoint and Microsoft FAST Search Server 2010 for Internet Sites with three courses for application developers and IT professionals