The Biggest Problems With Microsoft's SharePoint Security Model

Dear all,

I truly think that SharePoint security model is clearly outdated for today's corporate environment. How does it create risk to the organization?

SharePoint's groups-based security model

SharePoint security is based on groups. Whether you favor SharePoint groups or Domain groups, either way the groups model is based on hundreds of long lists of people’s names.

Groups must be manually populated with the people who should get access to information - a tedious task which is highly prone to human error.

SharePoint makes it simple to add new users who transition into relevant roles and assignments, but there is no clean-up of permissions when they transition back out.

And besides, organizations aren’t typically structured around groups – they are structured around people having roles, credentials and assignments. People move around and shift focus all the time.

SharePoint also provides very little support for an information owner trying to add the correct group to their SharePoint site. It is far too easy to make a mistake, and there is no help to detect if one has been made.

And so, without confidence in their actions to secure their information in SharePoint, the information owner will often feel it could be better to start yet another new group. And the wheel gets reinvented again!

The importance of maintenance

Modern organizations are dynamic places. People move around organizations regularly. Organizational structures change regularly. In fact, change may be the only real constant!

And so, because SharePoint security is based on lists of people's names, those lists must be constantly maintained. We need to ensure that the set of people getting access to information remains appropriate as business circumstances change.

But groups in SharePoint include no clear link to the original reason a person may be a member – so how are we to evaluate if it remains appropriate? Especially when the maintenance task falls to IT - who may be quite distant from the information involved, and who often don't have first-hand knowledge of the information or people involved. How can they possibly be expected to make good proactive decisions about who should keep their access?

Experience has shown that as many as 30% of SharePoint site owners have left their company or moved jobs. Over 50% of SharePoint sites are abandoned within 3 years, but sensitive documents remain accessible.

Permissions in SharePoint often get in a tangled mess - and people tend to accumulate access to information as they move around over time.

And the larger or more complex the organization, the more DIFFICULT, EXPENSIVE, and INACCURATE maintenance becomes.

'Silent' permissions

SharePoint includes several ways to gain access to information. Some of these are not visible to information owners.

For examine, information owners can’t see who are members of Domain groups. Also, Domain groups can be nested inside other groups, also without information owners knowledge.

Site Collection Administration rights, and Web Application Policies can effectively provide ‘silent’ access. That is, permissions for people to information without the knowledge of information owners. Although this function exists for the legitimate purpose of enabling administration of the system - the fact that information owners can't see this can create significant problems.

Ultimately, lack of visibility undermines trust.

The consequences of lack of visibility

SharePoint is designed to promote information sharing, but security information is not clearly visible.

Take a standard SharePoint document library. Exactly who can access it? Its not easy to tell. Users can’t easy know what permissions are on the SharePoint sites they are trusting their documents to.

SharePoint's ‘Shared With’ dialog is slow and unreliable. The ‘Manage Permissions’ page is buried inside settings.

Administrative permissions, such as Site Collection Administration rights, and Web Application Policies are hidden from users and information owners.

Membership of groups is hidden – we only see the group name, which may or may not be descriptive, helpful or consistent. And there is no way to view the membership of Domain groups

Without the trust of information owners, adoption and value is compromised.

And this can lead to an attitude of security being ‘someone else’s problem’ – rather than promoting a culture of shared responsibility!

Risk to the organization constantly grows

Since SharePoint began 15 years ago:

• The volumes of information we deal with,
• the general dynamism of organizations, and
• the intensity of the security threat

...have increased exponentially! SharePoint’s groups-based security model has seen very little evolution over that time.

Ultimately, these factors create weaknesses in your information security armour - increasing risk to the organization of a serious security incident. You can read more here on solutions to tackle these problems.

Have you experienced these issues?

Let me know your thoughts

Peter

@TorsionIS

Let's #MakeSharePointGreatAgain together.