Windows File Server Security Audit

Abstract

When you audit your servers and workstations across your network to find out who has access to what and what actions they can perform on these folders and files, the most important challenge that you face is the sheer volume of data in the form of ACLs or Access Control Lists. Permissions are granted to Accounts, such as users and groups, whose Access Control Entries (ACE) run in to several hundreds of thousands of entries across folders and files. The volume of entries will discourage any manual analysis of NTFS permissions on folders and files.

Challenge #1: Who has access to what in your Files, Folders and Shares?

While this may seem like a simple question for the management, this is a tough one to handle for administrators or managers. This requires you to first identify all your important folders and files and then estimate the number of ACE entries that are likely to be there. You then need to figure out who should and should not have permissions to these. The most important security question to answer is – who is having unauthorized access where? This is like finding a needle in a hay stack. Most of the entries are too monotonous and strenuous to manually look at with the same granular permission entries showing up everywhere in your report.

Challenge #2: What type of access has been granted?

All unauthorized accesses need to be analyzed along with the type of unauthorized access – can the unauthorized user or group Read or Modify or Delete confidential Files and Folders? To find exceptions you need a solution that will allow you to setup roles and templates for effectively reviewing permissions.

Challenge #3: What happened to accesses that were granted to people who are currently not in the organization?

This is often referred to as permissions clutter or permissions bloat. The permissions given to users and groups accumulate over a period of time if the administrators do not perform regular cleanups of ACLs. This is easier said than done because of the missing links and updates from HR systems to Systems management tools. Do deleted or unknown users have access to files and folders? Unless there is an automated solution, cleanups never happen and as a result ACLs accumulate over a period of time, compromising security.

Challenge #4: Who have been given special/explicit permissions on folders?

There are always exceptions in any organization where confidential folders and files get special treatment in the form of blocked inheritance and explicit permissions are granted for privileged access. This is one area that needs careful monitoring and needs to be documented properly. In which folders and files the normal rules such as “inheritance of permissions by folders from parent” apply and where have they been blocked or subverted?

Challenge #5: Indirect access to folders and files – unauthorized access to confidential files and folders indirectly because of users and groups getting privileged group access due to some form of nested group membership.

This is very dangerous and likely to happen when there are too many privileged accesses to shared folders. This needs to be resolved by analyzing indirect permissions on shares, folders and files.

Challenge #6: Security threat or administrative headache posed by unwanted and unauthorized setting up of shares on workstations that users hardly pay any attention too. This is an administrative nightmare when people temporarily start sharing folders and files for specific projects or group work assignments and then leave them around forever. How are people sharing folders from their workstations? Do these Shares in workstations need further security scrutiny?

Vyapin’s NTFS Security auditing solution addresses all the above challenges by providing a single comprehensive solution for NTFS permissions reporting across your enterprise.