SBC 2012 - Dynamic Access Control in Windows Server 2012 (Nguyễn Ngọc Thuận)
Security Bootcamp 2012 - 28,29,30/12/2012
Microsoft SharePoint Most Valuable Professional (2011,2012) Author, Writer, Trainer & Public Speaker Founder & Editor in Chief of SharePointVN Publisher Focus on Microsoft Security & Federation Identity, Infrastructure, Methodologies and Architecture.
Data Compliance Understand the new Dynamic Access Control capabilities built into Windows Server 2012 Demonstration
Compliance is generally a response to governmental regulation, but it can also be a response to industry or internal requirements. The U.S. Health Insurance Portability and Accountability Act (HIPPA) for health providers Sarbanes-Oxley Act (SOX) The European Union Data Protection Directive U.S. state data breach laws I’m not talking about in-depth Data complianceand privacy.
Can you make sure that only authorized individuals can access confidential data? Do you have granular control over auditing access? How to reduce the number of security groups your organization has? Deal with regulatory standard?…. There are many questions come up when it comes to data access control. Content Owner Information CSO/CIO Infrastructure Workder department Support ““Is my important data “I need to have appropriately “I don’t know if I the right “I don’t know protected and am complying compliance what data is in my compliant with with my controls to keep repositories and regulations – how organization’s me out of jail” how to control it” do I audit this” polices”
Distributed RegulatoryStorage growth Information compliance Data leakage 45%: File based storage Corporate information is New and changing 246,091,423: Total CAGR. everywhere: Desktops, regulations (SOX, HIPPA, number of records Branch Offices, Data GLBA…) containing sensitive MSIT cost $1.6 Centers, Cloud… personal information GB/Month for managed International and local involved in security servers. MSIT 1500 file servers regulations. breaches in the US since with 110 different groups >70%: of stored data is More oversight and January 2005 managing them stale tighter enforcement. $90 to $305 per record Very hard to consistently Cloud cost would be $15M: Settlement for (Forrester: in “Calculating manage the information. approximately 25 cents investment bank with the Cost of a Security GB/Month SEC over record Breach”) retention.
Expression-based Expression-basedData Classification auditing access conditions Encryption Classify your documents Targeted access auditing Flexible access control Automatic RMS using resource properties based on document lists based on document encryption based on stored in Active classification and user classification and document classification. Directory. identity. multiple identities (security groups). Automatically classify Centralized deployment documents based on of audit policies using Centralized access document content. Global Audit Policies. control lists using Central Access Policies.
Data Classification File Classification Infrastructure provides insight into your data by automating classification processes.Data Classification File Classification Infrastructure uses classification rules to automatically scan files and classify them according to the contents Classify your documents of the file. using resource properties Some examples of classification rules include: stored in Active Directory. Classify any file that contains the string “SBC12 Confidential” as having high business impact. Automatically classify documents based on Classify any file that contains at least 10 social security document content. numbers as having personally identifiable information.
A content classification rule that searches a set of files for the string “SBC12 Confidential”. If the string is found in a file, the ImpactData Classification resource property is set to High on the file. A content classification rule that searches a set of files for a regular Classify your documents expression that matches a social security number at least 10 times using resource properties in one file. If the pattern is found, the file is classified as having stored in Active Directory. personally identifiable information and the Personally Identifiable Information resource property is set to High. Automatically classify documents based on document content.
Expression-based access condition Manage fewer security groups by using conditional expressionsExpression-basedaccess conditions Country x 30 Flexible access control lists based on document classification and multiple identities (security groups). Department x 20 Centralized access control lists using Central Access Policies. Sensitive/Confidential documents
What is Central Access Policy? You can think of Central Access Policies as a safety net that your organization applies across its servers to enhance the local access policy
Expression-based access rules Active Directory File server Domain Services User claims Device claims Resource properties User.Department = Finance Device.Department = Finance Resource.Department = Finance User.Clearance = High Device.Managed = True Resource.Impact = High Access policy Applies to: @File.Impact = HighAllow | Read, Write | if (@User.Department == @File.Department) AND (@Device.Managed == True)
Central access policies Active Directory Domain Services CorporateHigh business file servers Organizationalimpact policy policies Characteristics • High business impact • Composed of central access rules • Personally identifiablePersonally information • Applied to file servers through Group Policyidentifiable objectsinformation policy Finance department • Supplement (not replace) native file and folder policies access control lists from New Technology File System (NTFS) • High business impactFinance policy • Personally identifiable information • Finance User folders Finance folders
Central access policy workflowActive Directory Create claim definitions Active Directory Create file property definitionsDomain Services Create central access policy Domain Services Send central access policies to fileGroup Policy servers Claim definitions User Apply access policy to the shared folder File property definitionsFile Server Identify information Allow or deny Audit policyUser’s computer User tries to access information File server
Central access policy examplesOrganization-wide Specific dataauthorization managementDepartmentalauthorization Need-to-know
Expression-based AuditingExpression-based Limit auditing to data that meets specificauditing classification criteria. Targeted access auditing Limit auditing by action and by identity based on document classification and user Add contextual information into the audit identity. events. Centralized deployment of audit policies using Global Audit Policies.
Security auditingActive Directory Active Directory Create claim typesDomain Services Create resource properties Domain ServicesGroup Policy Create global audit policy Claim definitions User Select and apply resource properties to the shared File property definitionsFile Server folders Allow or deny Audit policyUser’s computer User tries to access information File server
Audit policy examplesAudit everyone who does not have a high security Audit all vendors when they try to accessclearance and who tries to access a document that documents related to projects that they are nothas a high impact on business working onAudit | Everyone | All-Access | Audit | Everyone | All-Access |Resource.BusinessImpact=HBI AND User.EmploymentStatus=Vendor AND User.ProjectUser.SecurityClearance!=High Not_AnyOf Resource.Project.
Data Encryption Challenges How do I protect sensitive information after it leaves my protected environment? I cannot get the users to encrypt their sensitive data.
Classification-based encryption process Process to encrypt a file based on 1 classification Active Directory Claim definitions, file property definitions, and access Domain Services policies are established in Active Directory Domain Controller. A user creates a file with the word “confidential” in the User text and saves it. The classification engine classifies 4 the file as high-impact according to rules configured. 2 On the file server, a rule automatically applies RMS protection to any file classified as high-impact. 3 The RMS template and encryption are applied to the RMS server file on the file server and the file is encrypted. Classification engine File server
Demonstration Lab There are two virtual machines that are involved in the demonstration lab. AD-Srv (Active Directory Domain Controller) File-Srv (File Server) There are two security groups Finance System Integration There are two domain users: email@example.com (Finance) firstname.lastname@example.org (System Integration)
Steps Create a new claim Department Create resources properties and add it to resource property list Finance Department Create a new central access rule/central policies Resource Finance Department Exists Resource Finance Department Equals Value Finance Publish central access policy Configure Group Policy and enable KDC Install File Server Resource Manager on File server Update-FSRMClassificationPropertyDefinition Add Central Access Policy to shared folder Validate