Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

SPS Belgium 2012 - End to End Security for SharePoint Farms - Michael Noel


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

SPS Belgium 2012 - End to End Security for SharePoint Farms - Michael Noel

  1. 1. #SPSBEEnd to End SharePoint Security #SPSBE19 Michael Noel @MichaelTNoel
  2. 2. MICHAEL NOEL• Author of SAMS Publishing titles “SharePoint 2010 Unleashed,” “SharePoint 2007 Unleashed,” “SharePoint 2003 Unleashed”, “Teach Yourself SharePoint 2003 in 10 Minutes,” “Windows Server 2008 R2 Unleashed,” “Exchange Server 2010 Unleashed”, “ISA Server 2006 Unleashed”, and many other titles .• Partner at Convergent Computing ( / +1(510)444-5700) – San Francisco Bay Area based Infrastructure/Security specialists for SharePoint, AD, Exchange, Security
  3. 3. SHAREPOINT SECURITYLAYERS OF SECURITY IN A SHAREPOINT ENVIRONMENT• 1: Infrastructure Security • Physical Security • Best Practice Service Account Setup • Kerberos Authentication• 2: Data Security • Role Based Access Control (RBAC) • Transparent Data Encryption (TDE) of SQL Databases • Antivirus• 3: Transport Security • Secure Sockets Layer (SSL) from Client to Server • IPSec from Server to Server• 4: Edge Security • Inbound Internet Security (Forefront UAG/TMG)• 5: Rights Management
  5. 5. LAYER 1: INFRASTRUCTURE SECURITY SAMPLE LIST OF SERVICE ACCOUNTSService Account Name Role of Service Account Special PermissionsCOMPANYABCSRV-SP-Setup SharePoint Installation Account Local Admin on all SP Servers (for installs)COMPANYABCSRV-SP-SQL SQL Service Account(s) – Should be separate admin Local Admin on Database Server(s) (Generally, some accounts from SP accounts. exceptions apply)COMPANYABCSRV-SP-Farm SharePoint Farm Account(s) – Can also be standard N/A admin accounts. RBAC principles apply ideally.COMPANYABCSRV-SP-Search Search Account N/ACOMPANYABCSRV-SP-Content Default Content Access Account Read rights to any external data sources to be crawledCOMPANYABCSRV-SP-Prof Default Profiles Access Account Member of Domain Users (to be able to read attributes from users in domain) and „Replicate Directory Changes‟ rights in AD – Temporary Farm Admin and Local Admin (for provisioning of UPA).COMPANYABCSRV-SP-AP-SPCA Application Pool Identity account for SharePoint DBCreator and Security Admin on SQL. Create Central Admin. and Modify contacts rights in OU used for mail.COMPANYABCSRV-SP-AP-Data Application Pool Identity account for the Content related N/A App Pool (Portal, MySites, etc.) Additional as needed for security.
  6. 6. LAYER 1: INFRASTRUCTURE SECURITY ENABLE KERBEROS• When creating any Web Applications in Classic-mode, USE KERBEROS. It is much more secure and also faster with heavy loads as the SP server doesn‟t have to keep asking for auth requests from AD.• Kerberos auth does require extra steps, which makes people shy away from it, but once configured, it improves security considerably and can improve performance on high-load sites.• Should also be configured on SPCA Site! (Best Practice = Configure SPCA for NLB, SSL, and Kerberos (i.e.
  7. 7. LAYER 1: INFRASTRUCTURE SECURITY KERBEROS STEP 1: CREATE THE SERVICE PRINCIPAL NAMES• Use the setspn utility to create Service Principle Names in AD, the following syntax for example: • Setspn.exe -A HTTP/ DOMAINNAMEMYSiteAppAccount • Setspn.exe -A HTTP/mysite DOMAINNAMEMYSITEAppAccount • Setspn.exe -A HTTP/ DOMAINNAMEHOMEAppAccount • Setspn.exe -A HTTP/sp DOMAINNAMEHOMEAppAccount
  8. 8. LAYER 1: INFRASTRUCTURE SECURITY KERBEROS STEP 2: ENABLE KERBEROS BETWEEN SP AND SQL• Use setspn to create SPNs for SQL Service Account• SPNs need to match the name that SharePoint uses to connect to SQL (Ideally SQL Alias, more on this later)• Syntax similar to following: • Setspn.exe -A MSSQLSvc/spsql:1433 COMPANYABCSRV-SQL-DB • Setspn.exe –A MSSQLSvc/ COMPANYABCSRV-SQL-DB• MSSQLSvc = Default instance, if named instance, specify the name instead• In this example, SRV-SQL-DB is the SQL Admin account and is the alias used to connect to SQL server (Listener/Client Access Point if using AlwaysOn Availability Groups with SQL 2012)
  9. 9. LAYER 1: INFRASTRUCTURE SECURITY KERBEROS STEP 3: ALLOW ACCOUNTS TO DELEGATE (OPTIONAL)• Required only for Excel Services and other impersonation applications.• On all SP Computer accounts and on the Application Identity accounts, check the box in ADUC to allow for delegation. • In ADUC, navigate to the computer or user account, right- click and choose Properties. • Go to the Delegation tab • Choose Trust this user/computer for delegation to any service (Kerberos)
  10. 10. LAYER 1: INFRASTRUCTURE SECURITY KERBEROS STEP 4: ENABLE KERBEROS ON WEB APPLICATION• Go to Application Management – Authentication Providers• Choose the appropriate Web Application• Click on the link for „Default‟ under Zone• Change to Integrated Windows Authentication - Kerberos (Negotiate)• Run iisreset /noforce from the command prompt• If creating Web App from scratch, this step may be unnecessary if you choose Negotiate from the beginning
  11. 11. DATA SECURITY Layer
  12. 12. LAYER 2: DATA SECURITYROLE BASED ACCESS CONTROL (RBAC)• Role Groups defined within Active Directory (Universal Groups) – i.e. „Marketing,‟ „Sales,‟ „IT,‟ etc.• Role Groups added directly into SharePoint „Access Groups‟ such as „Contributors,‟ „Authors,‟ etc.• Simply by adding a user account into the associated Role Group, they gain access to whatever rights their role requires. User1 SharePoint Role Group or Group direct rights to SP User2
  13. 13. LAYER 2: DATA SECURITY SQL TRANSPARENT DATA ENCRYPTION (TDE)• SQL Server 2008, 2008 R2, 2012 Enterprise Edition Feature• Encrypts SQL Databases Transparently, SharePoint is unaware of the encryption and does not need a key• Encrypts the backups of the database as well
  14. 14. LAYER 2: DATA SECURITY TDE VS. CELL LEVEL ENCRYPTION• Available with either SQL 2005, SQL 2008, or SQL 2012• Encrypts individual cells in a database• Requires a password to access the cell• Requires that columns be changed from their original data type to varbinary• Advantage is that only specific info is encrypted• Disadvantage is that you cannot use this for SharePoint Databases
  15. 15. LAYER 2: DATA SECURITY TDE VS. FILE LEVEL ENCRYPTION• Two forms, older Encrypting File System (EFS) and Bitlocker• EFS encrypts data at the File Level• Bitlocker encrypts data at the Volume Level• Bitlocker Encrypts every file on the disk, not just database files• Could be used together with TDE
  16. 16. LAYER 2: DATA SECURITY SQL TRANSPARENT DATA ENCRYPTION (TDE) LIMITATIONS• Does not encrypt the Communication Channel (IPSec can be added)• Does not protect data in memory (DBAs could access)• Cannot take advantage of SQL 2008 Backup Compression• TempDB is encrypted for the entire instance, even if only one DB is enabled for TDE, which can have a performance effect for other DBs• Replication or FILESTREAM data is not encrypted when TDE is enabled (i.e. RBS BLOBs not encrypted)
  17. 17. Key and OS Level Hierarchy Windows Cert Data Protection API (DPAPI) DPAPI Encrypts SMK SQL Instance Level Service Master Key SMK encrypts the DMK for master DB master DB Level Database Master Key DMK creates Cert in master DB master DB Level Certificate Certificate Encrypts DEK in Content DB Content DB Level Database Encryption Key DEK used to encrypt Content DB
  18. 18. LAYER 2: DATA SECURITY SQL TDE STEP 1: CREATING THE DATABASE MASTER KEY (DMK)• Symmetric key used to protect private keys and asymmetric keys• Protected itself by Service Master Key (SMK), which is created by SQL Server setup• Use syntax as follows: • USE master; • GO • CREATE MASTER KEY ENCRYPTION BY PASSWORD = CrypticTDEpw4CompanyABC; • GO
  19. 19. LAYER 2: DATA SECURITY SQL TDE STEP 2: CREATING THE TDE CERTIFICATE• Protected by the DMK• Used to protect the database encryption key• Use syntax as follows: USE master; GO CREATE CERTIFICATE CompanyABCtdeCert WITH SUBJECT = CompanyABC TDE Certificate ; GO
  20. 20. LAYER 2: DATA SECURITY SQL TDE STEP 3: BACKUP THE MASTER KEY• Without a backup, data can be lost• Backup creates two files, the Cert backup and the Private Key File• Use following syntax: USE master; GO BACKUP CERTIFICATE CompanyABCtdeCert TO FILE = c:BackupCompanyABCtdeCERT.cer WITH PRIVATE KEY ( FILE = c:BackupCompanyABCtdeDECert.pvk, ENCRYPTION BY PASSWORD = CrypticTDEpw4CompanyABC! ); GO
  21. 21. LAYER 2: DATA SECURITY SQL TDE STEP 4: CREATING THE DATABASE ENCRYPTION KEY (DEK)• DEK is used to encrypt specific database• One created for each database• Encryption method can be chosen for each DEK• Use following syntax: USE SharePointContentDB; GO CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_256 ENCRYPTION BY SERVER CERTIFICATE CompanyABCtdeCert GO
  22. 22. LAYER 2: DATA SECURITY SQL TDE STEP 5: ENABLE TDE ON THE DATABASE(S)• Data encryption will begin after running command• Size of DB will determine time it will take, can be lengthy and could cause user blocking• Use following syntax: USE SharePointContentDB GO ALTER DATABASE SharePointContentDB SET ENCRYPTION ON GO
  23. 23. LAYER 2: DATA SECURITY SQL TDE STEP 6: MONITOR THE TDE ENCRYPTION PROGRESS• State is Returned• State of 2 = Encryption Begun• State of 3 = Encryption Complete• Use following syntax: USE SharePointContentDB GO SELECT * FROM sys.dm_database_encryption_keys WHERE encryption_state = 3; GO
  24. 24. LAYER 2: DATA SECURITY SQL TDE: RESTORING A TDE DATABASE TO ANOTHER SERVER• Step 1: Create new Master Key on Target Server (Does not need to match source master key)• Step 2: Backup Cert and Private Key from Source• Step 3: Restore Cert and Private Key onto Target (No need to export the DEK as it is part of the backup) USE master; GO CREATE CERTIFICATE CompanyABCtdeCert FROM FILE = C:RestoreCompanyABCtdeCert.cer WITH PRIVATE KEY ( FILE = C:RestoreCompanyABCtdeCert.pvk , DECRYPTION BY PASSWORD = CrypticTDEpw4CompanyABC! )• Step 4: Restore DB
  26. 26. LAYER 2: DATA SECURITY SHAREPOINT ANTIVIRUS VSAPI• Realtime scanning only uses the VSAPI• Realtime Scan Settings are Administered through the SharePoint Central Admin Tool • Realtime Options are grayed out in the ForeFront Admin Console
  27. 27. LAYER 2: DATA SECURITY SHAREPOINT ANTIVIRUS: FPS KEYWORD AND FILE FILTERING• Look for specific keywords (sensitive company info, profanity, etc.) • Block • Simply detect and notify• Create Filter List • Add Keywords, either manually or bulk as lines in a text file
  28. 28. LAYER 2: DATA SECURITY SHAREPOINT ANTIVIRUS: FPS PROFANITY FILTERS• New Profanity lists in 11 languages available in SP2 • (Run KeywordInstaller.msi to install) • Import the lists into FF from Program FilesMicrosoft Forefront SecuritySharePointDataExample Keywords
  30. 30. LAYER 3: TRANSPORT SECURITY CLIENT TO SERVER: USING SECURE SOCKETS LAYER (SSL) ENCRYPTION• External or Internal Certs highly recommended• Protects Transport of content• 20% overhead on Web Servers• Can be offloaded via SSL offloaders if needed• Don‟t forget for SPCA as well!
  31. 31. LAYER 3: TRANSPORT SECURITY SERVER TO SERVER: USING IPSEC TO ENCRYPT TRAFFIC• By default, traffic between SharePoint Servers (i.e. Web and SQL) is unencrypted• IPSec encrypts all packets sent between servers in a farm• For very high security scenarios when all possible data breaches must be addressed
  32. 32. EDGE SECURITY Layer
  34. 34. LAYER 4: EDGE SECURITY UAG COMPARISON WITH FOREFRONT TMGCapability TMG 2010 UAG 2010Publish Web applications using HTTPS X XPublish internal mobile applications to roaming mobile devices X XLayer 3 firewall X XOutbound scenarios support X XArray support X XGlobalization and administration console localization X XWizards and predefined settings to publish SharePoint sites and Exchange X XRich authentication (for example, one-time password, forms-based, smart card) X XApplication protection (Web application firewall) Basic FullActive Directory Federation Services (ADFS) support XInformation leakage prevention XGranular access policy XUnified Portal X
  36. 36. LAYER 5: RIGHTS MANAGEMENT ACTIVE DIRECTORY RIGHTS MANAGEMENT SERVICES (AD RMS)• AD RMS is a form of Digital Rights Management (DRM) technology, used in various forms to protect content• Used to restrict activities on files AFTER they have been accessed: • Cut/Paste • Print • Save As…• Directly integrates with SharePoint DocLibs
  37. 37. LAYER 5: RIGHTS MANAGEMENT HOW AD RMS WORKS1. On first use, authors receive client licensor certificate from RMS server2. Author creates content and assigns rights3. File is distributed to recipient(s)4. Recipient opens file, and their RMS client contacts server for user validation and to obtain a license5. Application opens the file and enforces the restrictions
  38. 38. LAYER 5: RIGHTS MANAGEMENT INSTALLING AD RMS – KEY STORAGE• Select Cluster Key Storage• CSP used for advanced scenarios
  41. 41. LAYER 5: RIGHTS MANAGEMENT ALLOWING SHAREPOINT TO USE AD RMS• By default, RMS server is configured to only allow the local system account of the RMS server or the Web Application Identity accounts to access the certificate pipeline directly• SharePoint web servers and/or Web Application Service Accounts need to be added to this security list• Add the RMS Service Group, the machine account(s) of the SharePoint Server and the Web App Identity accountswith Read and Excecute permissions to the ServerCertification.asmx file in the %systemroot%inetpubwwwroot_wmcsCerti fication folder on the RMS server
  42. 42. LAYER 5: RIGHTS MANAGEMENT CLIENT ACCESSING AD RMS DOCUMENTS• Effective permissions can be viewed from the document• The RMS client will enforce the restrictions
  43. 43. SESSION SUMMARY• Determine Security Risk for your SharePoint Environment• Identify any Regulatory Compliance Requirements for SharePoint• Determine which aspects of SharePoint need to be secured, touching on all five layers of SharePoint Security
  44. 44. Michael Noel Twitter: @MichaelTNoel www.cco.comSlides: blog:
  45. 45. A big thanks to our sponsorsPlatinum SponsorsGold Premium Sponsors Venue SponsorGold Sponsors
  46. 46. We need your feedback! Scan this QR code or visit Our sponsors: