Understanding the
Layers of SharePoint
Security
Michael Noel - CCO
@MichaelTNoel #SPSJHB
The first ever all green SharePoint event on earth
19 May 2012
Michael Noel
•
•
Author of SAMS Publishing titles “SharePoint 2010 Unleashed,” “SharePoint 2007
Unleashed,” “SharePoint 2003 Unleashed”, “Teach Yourself SharePoint 2003 in 10
Minutes,” “Windows Server 2008 R2 Unleashed,” “Exchange Server 2010 Unleashed”,
“ISA Server 2006 Unleashed”, and many other titles .
Partner at Convergent Computing (www.cco.com / +1(510)444-5700) – San Francisco
Bay Area based Infrastructure/Security specialists for SharePoint, AD, Exchange,
Security
SharePoint Security
Layers of Security in a SharePoint Environment
•
1: Infrastructure Security
–
–
–
•
2: Data Security
–
–
–
•
Secure Sockets Layer (SSL) from Client to Server
IPSec from Server to Server
4: Edge Security
–
•
Role Based Access Control (RBAC)
Transparent Data Encryption (TDE) of SQL Databases
Antivirus
3: Transport Security
–
–
•
Physical Security
Best Practice Service Account Setup
Kerberos Authentication
Inbound Internet Security (Forefront UAG/TMG)
5: Rights Management
Infrastructure Security
Layer
Layer 1: Infrastructure Security
Sample List of Service Accounts
Service Account Name
Role of Service Account
Special Permissions
COMPANYABC\SRV-SP-Setup
SharePoint Installation Account
Local Admin on all SP Servers (for installs)
COMPANYABC\SRV-SP-SQL
SQL Service Account(s) – Should be separate admin
accounts from SP accounts.
Local Admin on Database Server(s) (Generally,
some exceptions apply)
COMPANYABC\SRV-SP-Farm
SharePoint Farm Account(s) – Can also be standard
admin accounts. RBAC principles apply ideally.
N/A
COMPANYABC\SRV-SP-Search
COMPANYABC\SRV-SP-Content
Search Account
Default Content Access Account
N/A
Read rights to any external data sources to be
crawled
COMPANYABC\SRV-SP-Prof
Default Profiles Access Account
Member of Domain Users (to be able to read
attributes from users in domain) and ‘Replicate
Directory Changes’ rights in AD – Temporary
Farm Admin and Local Admin (for provisioning
of UPA).
COMPANYABC\SRV-SP-AP-SPCA
Application Pool Identity account for SharePoint
Central Admin.
DBCreator and Security Admin on SQL. Create
and Modify contacts rights in OU used for mail.
COMPANYABC\SRV-SP-AP-Data
Application Pool Identity account for the Content
related App Pool (Portal, MySites, etc.) Additional
as needed for security.
N/A
Layer 1: Infrastructure Security
Enable Kerberos
• When creating any Web Applications in Classic-mode, USE
KERBEROS. It is much more secure and also faster with heavy
loads as the SP server doesn’t have to keep asking for auth
requests from AD.
• Kerberos auth does require extra steps, which makes people
shy away from it, but once configured, it improves security
considerably and can improve performance on high-load sites.
• Should also be configured on SPCA Site! (Best Practice =
Configure SPCA for NLB, SSL, and Kerberos (i.e.
https://spca.companyabc.com)
Layer 1: Infrastructure Security
Kerberos Step 1: Create the Service Principal Names
• Use the setspn utility to create Service Principle Names in
AD, the following syntax for example:
– Setspn.exe -A HTTP/mysite.companyabc.com
DOMAINNAME\MYSiteAppAccount
– Setspn.exe -A HTTP/mysite DOMAINNAME\MYSITEAppAccount
– Setspn.exe -A HTTP/home.companyabc.com
DOMAINNAME\HOMEAppAccount
– Setspn.exe -A HTTP/sp DOMAINNAME\HOMEAppAccount
Layer 1: Infrastructure Security
Kerberos Step 2: Enable Kerberos between SP and SQL
• Use setspn to create SPNs for SQL Service Account
• SPNs need to match the name that SharePoint uses to
connect to SQL (Ideally SQL Alias, more on this later)
• Syntax similar to following:
– Setspn.exe -A MSSQLSvc/spsql:1433 COMPANYABC\SRV-SQL-DB
– Setspn.exe –A MSSQLSvc/spsql.companyabc.com:1433
COMPANYABC\SRV-SQL-DB
• MSSQLSvc = Default instance, if named instance, specify the name
instead
• In this example, SRV-SQL-DB is the SQL Admin account and
spsql.companyabc.com is the alias used to connect to SQL server
(Listener/Client Access Point if using AlwaysOn Availability Groups
with SQL 2012)
Layer 1: Infrastructure Security
Kerberos Step 3: Allow Accounts to Delegate (Optional)
• Required only for Excel
Services and other
impersonation applications.
• On all SP Computer accounts
and on the Application
Identity accounts, check the
box in ADUC to allow for
delegation.
– In ADUC, navigate to the
computer or user account,
right-click and choose
Properties.
– Go to the Delegation tab
– Choose Trust this
user/computer for delegation
to any service (Kerberos)
Layer 1: Infrastructure Security
Kerberos Step 4: Enable Kerberos on Web Application
•
•
•
•
Go to Application Management – Authentication Providers
Choose the appropriate Web Application
Click on the link for ‘Default’ under Zone
Change to Integrated Windows Authentication - Kerberos
(Negotiate)
• Run iisreset /noforce from the command prompt
• If creating Web App from scratch, this step may be unnecessary
if you choose Negotiate from the beginning
DATA SECURITY
Layer
Layer 2: Data Security
Role Based Access Control (RBAC)
• Role Groups defined within Active Directory (Universal
Groups) – i.e. ‘Marketing,’ ‘Sales,’ ‘IT,’ etc.
• Role Groups added directly into SharePoint ‘Access Groups’
such as ‘Contributors,’ ‘Authors,’ etc.
• Simply by adding a user account into the associated Role
Group, they gain access to whatever rights their role
requires.
User1
Role
Group
User2
SharePoint
Group or
direct rights
to SP
Layer 2: Data Security
SQL Transparent Data Encryption (TDE)
• SQL Server 2008, 2008 R2, 2012 Enterprise
Edition Feature
• Encrypts SQL Databases Transparently,
SharePoint is unaware of the encryption and
does not need a key
• Encrypts the backups of the database as well
Layer 2: Data Security
TDE vs. Cell Level Encryption
•
•
•
•
Available with either SQL 2005, SQL 2008, or SQL 2012
Encrypts individual cells in a database
Requires a password to access the cell
Requires that columns be changed from their original data
type to varbinary
• Advantage is that only specific info is encrypted
• Disadvantage is that you cannot use this for SharePoint
Databases
Layer 2: Data Security
TDE vs. File Level Encryption
• Two forms, older Encrypting File System (EFS) and
Bitlocker
• EFS encrypts data at the File Level
• Bitlocker encrypts data at the Volume Level
• Bitlocker Encrypts every file on the disk, not just
database files
• Could be used together with TDE
Layer 2: Data Security
SQL Transparent Data Encryption (TDE) Limitations
• Does not encrypt the Communication Channel (IPSec can be
added)
• Does not protect data in memory (DBAs could access)
• Cannot take advantage of SQL 2008 Backup Compression
• TempDB is encrypted for the entire instance, even if only one
DB is enabled for TDE, which can have a performance effect
for other DBs
• Replication or FILESTREAM data is not encrypted when TDE is
enabled (i.e. RBS BLOBs not encrypted)
Level Hierarchy
Data Protection API (DPAPI)
Key Windows
and OS
Cert
DPAPI Encrypts SMK
SQL Instance Level
Service Master Key
SMK encrypts the DMK for master DB
master DB Level
Database Master Key
DMK creates Cert in master DB
master DB Level
Certificate
Certificate Encrypts DEK in Content DB
Content DB Level
Database Encryption Key
DEK used to encrypt Content DB
Layer 2: Data Security
SQL TDE Step 1: Creating the Database Master Key (DMK)
•
•
•
Symmetric key used to protect private keys and asymmetric keys
Protected itself by Service Master Key (SMK), which is created by SQL Server setup
Use syntax as follows:
– USE master;
– GO
– CREATE MASTER KEY ENCRYPTION BY PASSWORD =
'CrypticTDEpw4CompanyABC';
– GO
Layer 2: Data Security
SQL TDE Step 2: Creating the TDE Certificate
• Protected by the DMK
• Used to protect the database encryption key
• Use syntax as follows:
USE master;
GO
CREATE CERTIFICATE CompanyABCtdeCert WITH SUBJECT = 'CompanyABC
TDE Certificate' ;
GO
Layer 2: Data Security
SQL TDE Step 3: Backup the Master Key
• Without a backup, data can be lost
• Backup creates two files, the Cert backup and the Private Key File
• Use following syntax:
USE master;
GO
BACKUP CERTIFICATE CompanyABCtdeCert TO FILE =
'c:\Backup\CompanyABCtdeCERT.cer'
WITH PRIVATE KEY (
FILE = 'c:\Backup\CompanyABCtdeDECert.pvk',
ENCRYPTION BY PASSWORD = 'CrypticTDEpw4CompanyABC!' );
GO
Layer 2: Data Security
SQL TDE Step 4: Creating the Database Encryption Key (DEK)
•
•
•
•
DEK is used to encrypt specific database
One created for each database
Encryption method can be chosen for each DEK
Use following syntax:
USE SharePointContentDB;
GO
CREATE DATABASE ENCRYPTION KEY
WITH ALGORITHM = AES_256
ENCRYPTION BY SERVER CERTIFICATE CompanyABCtdeCert
GO
Layer 2: Data Security
SQL TDE Step 5: Enable TDE on the Database(s)
• Data encryption will begin after running command
• Size of DB will determine time it will take, can be lengthy and
could cause user blocking
• Use following syntax:
USE SharePointContentDB
GO
ALTER DATABASE SharePointContentDB
SET ENCRYPTION ON
GO
Layer 2: Data Security
SQL TDE Step 6: Monitor the TDE Encryption Progress
•
•
•
•
State is Returned
State of 2 = Encryption Begun
State of 3 = Encryption Complete
Use following syntax:
USE SharePointContentDB
GO
SELECT *
FROM sys.dm_database_encryption_keys
WHERE encryption_state = 3;
GO
Layer 2: Data Security
SQL TDE: Restoring a TDE Database to Another Server
• Step 1: Create new Master Key on Target Server (Does not need to match
source master key)
• Step 2: Backup Cert and Private Key from Source
• Step 3: Restore Cert and Private Key onto Target (No need to export the
DEK as it is part of the backup)
USE master;
GO
CREATE CERTIFICATE CompanyABCtdeCert
FROM FILE = 'C:\Restore\CompanyABCtdeCert.cer'
WITH PRIVATE KEY (
FILE = 'C:\Restore\CompanyABCtdeCert.pvk'
, DECRYPTION BY PASSWORD = 'CrypticTDEpw4CompanyABC!'
)
• Step 4: Restore DB
Layer 2: Data Security
SharePoint Antivirus
Layer 2: Data Security
SharePoint Antivirus VSAPI
• Realtime scanning only uses the VSAPI
• Realtime Scan Settings are Administered through the
SharePoint Central Admin Tool
– Realtime Options are grayed out in the ForeFront Admin
Console
Layer 2: Data Security
SharePoint Antivirus: FPS Keyword and File Filtering
• Look for specific
keywords (sensitive
company info,
profanity, etc.)
– Block
– Simply detect and
notify
• Create Filter List
– Add Keywords, either
manually or bulk as
lines in a text file
Layer 2: Data Security
SharePoint Antivirus: FPS Profanity Filters
• New Profanity lists in 11 languages
available in SP2
– (Run KeywordInstaller.msi to install)
– Import the lists into FF from \Program
Files\Microsoft Forefront
Security\SharePoint\Data\Example
Keywords
TRANSPORT SECURITY
Layer
Layer 3: Transport Security
Client to Server: Using Secure Sockets Layer (SSL) Encryption
•
•
•
•
•
External or Internal Certs highly recommended
Protects Transport of content
20% overhead on Web Servers
Can be offloaded via SSL offloaders if needed
Don’t forget for SPCA as well!
Layer 3: Transport Security
Server to Server: Using IPSec to encrypt traffic
• By default, traffic between SharePoint Servers (i.e.
Web and SQL) is unencrypted
• IPSec encrypts all packets sent between servers in
a farm
• For very high security scenarios when all possible
data breaches must be addressed
EDGE SECURITY
Layer
Layer 4: Edge Security
Forefront Unified Access Gateway (UAG) 2010
Layer 4: Edge Security
UAG Comparison with Forefront TMG
Capability
TMG 2010 UAG
2010
Publish Web applications using HTTPS
Publish internal mobile applications to roaming mobile devices
X
X
Layer 3 firewall
Outbound scenarios support
Array support
Globalization and administration console localization
X
X
X
X
Wizards and predefined settings to publish SharePoint sites and Exchange
X
Rich authentication (for example, one-time password, forms-based, smart card)
X
Application protection (Web application firewall)
Active Directory Federation Services (ADFS) support
Information leakage prevention
Granular access policy
Unified Portal
Basic
X
X
X
X
X
X
X
X
Full
X
X
X
X
RIGHTS MANAGEMENT
Layer
Layer 5: Rights Management
Active Directory Rights Management Services (AD RMS)
• AD RMS is a form of Digital Rights Management (DRM)
technology, used in various forms to protect content
• Used to restrict activities on files AFTER they have
been accessed:
– Cut/Paste
– Print
– Save As…
• Directly integrates with SharePoint DocLibs
Layer 5: Rights Management
Installing AD RMS – Key Storage
• Select Cluster Key Storage
• CSP used for advanced scenarios
Layer 5: Rights Management
Installing AD RMS – Creating the Cluster Name
Layer 5: Rights Management
Installing AD RMS – Using an SSL Cert for Transport Encryption
Layer 5: Rights Management
Allowing SharePoint to use AD RMS
•
•
•
By default, RMS server is configured to
only allow the local system account of the
RMS server or the Web Application
Identity accounts to access the certificate
pipeline directly
SharePoint web servers and/or Web
Application Service Accounts need to be
added to this security list
Add the RMS Service Group, the machine
account(s) of the SharePoint Server and
the Web App Identity accountswith Read
and Excecute permissions to the
ServerCertification.asmx file in the
%systemroot%\inetpub\wwwroot\_wmcs
\Certification folder on the RMS server
Layer 5: Rights Management
Client Accessing AD RMS Documents
• Effective
permissions can be
viewed from the
document
• The RMS client will
enforce the
restrictions
Session Summary
• Determine Security Risk for your SharePoint
Environment
• Identify any Regulatory Compliance Requirements for
SharePoint
• Determine which aspects of SharePoint need to be
secured, touching on all five layers of SharePoint
Security
Michael Noel
Twitter: @MichaelTNoel
www.cco.com
Slides: slideshare.net/michaeltnoel