In situations like this, one of our systems engineers recommends starting with providing data owners simple to review reports about who is accessing their data on a weekly basis. These reports can be scheduled for automatic delivery with software such as Varonis DatAdvantage.

Every week, the owners of critical folders receive a report with the list of users who have actually accessed data in their folder, and how many access events (opens, creates, deletes, etc.) they’ve generated over the previous week:

Simple DatAdvantage Statistics Report

If a data owner sees someone accessing their data that shouldn’t be, they can tell the administrators to remove access, remove it themselves via Varonis DataPrivilege, and/or reach out to that user directly. If desired, they can get a more detailed report of exactly what each user did in their folder.

In many cases administrators require access but they should not be examining or modifying business content. These reports are also helpful to keep an eye on administrative activity.

Eventually, global access groups will be removed and data owners will begin performing regular entitlement reviews to ensure that access control lists are maintained and as lean as possible. Organizations in-the-know have already begun the process of auditing actual access, removing global access groups (everyone, authenticated users, domain users, etc.) aligning data owners and groups with data, and performing entitlement reviews. In the meantime, access can be monitored and reviewed—a good start to improve data security.

For more information, read the white paper, Revolutionize Your Permissions Management.

However, new groups do add new relationships to Active Directory, and this ties into the topic I mentioned last week called "token bloat," referring to growing access tokens. In a nutshell, when a user's access token gets too big, sometimes they can't log in to their workstations. This is a high-priority help desk call when it happens to any user—when this happens to your CEO it is definitely sub-optimal.

Why does it happen? Access tokens are created when users authenticate with Active Directory, and they store a lot of SIDs, or Security Identifiers. Each group you're in adds a SID to your token. Each group those groups are in adds a SID to your token, and so on. SID history also adds SIDS to your token. By default, the number of SIDs your Active Directory access token can contain is 1024—if your token contains more than 1,024 SIDs, you may not be able to log in.

In addition to the obvious security benefits, this token limitation is another good reason to remove users from unneeded groups, identify and remediate deeply nested/looped nested groups, eliminate security groups that aren't used to access any resources, and to clean up SID history. Automated recommendations and reports about these and other issues are included in Varonis DatAdvantage.

Another piece of news is that there is a registry setting that increases the size of the token, described here. We have tested this successfully and we’re curious to see how it’s working for other folks. Please email me at dgibson@varonis.com if you have feedback.

Thanks to Sundar Ramakrishnan, who wrote a very helpful write-up, here.

In order to reign in "group sprawl," one practice that is becoming more popular is using single-purpose groups. A shared folder will have two groups: a read group and a write group, and those groups aren't to be used anywhere else. The actual implementation varies a bit depending on whether you use the AGLP/UGLY model, but the end result is groups are aligned to a single data resource. With this approach it makes little difference whether you review access from the group or the data perspective.

One question that naturally follows is, "Aren't we going to end up with a ton of groups?" We'll address that in my next post about "token bloat."

In the meantime, we've created a new movie about automating Entitlement Reviews.

Let's take a look at how EMC leveraged all three products. EMC has over two petabytes of unstructured data on file shares and Celerra NAS devices. To get a handle on some of the risk associated with that data, EMC scanned the content of those shares with RSA DLP, uncovering more than 30,000 files containing sensitive information. The challenge was to remediate those files by moving them to secure locations, deleting them, or locking down access to appropriate users. EMC set an aggressive goal: all remediation should be completed in less than two months.

The key for EMC was to identify and involve the business owners of the assets so that the remediation didn’t affect the business. EMC needed to know who had the proper context to make these decisions, so they leveraged Varonis. By looking at actual file access, EMC was quickly able to determine likely data owners for all 30,000 files—around 1,200 users. 

The next step for EMC's risk organization was to involve those 1,200 business users and find out what needed to be done about all of that sensitive content. EMC leveraged Archer's assessment functionality to reach out to the owners and query them on each file. Data owners received custom questionnaires about each sensitive file they owned. Out of 1,200 users who owned sensitive data, only 150 responded saying they needed to retain the data. Archer was then used to track the remediation and encryption of each of the 30,000 incidents. Archer can prove the process was completed, and Varonis and RSA DLP are used to ensure that any new data is protected accordingly.

Written by Brian Vecci – Technical Marketing Manager Varonis

For example, it's pretty intuitive that you can’t identify permissions problems (like folders exposed to the everyone group) without enumerating access control lists, but it's not so intuitive that you can't easily fix them without a framework that can use the audit trail to determine who actually needs permissions to each folder.  Here is a chart that lists specific data governance use cases, and the metadata streams that are required for each one:

For more information, read the white paper: The Metadata Imperative.

David Gibson, Director of Strategic Accounts and Technical Marketing

“With traditional approaches, it was very difficult to understand access to mailboxes and public folders across all the Exchange servers, effectively audit email access and communication, and find owners for public folders and mailboxes,” said Bernard Besohe, local mail and system administrator for the Publications Office of the European Union. “With Varonis DatAdvantage for Exchange, we have significantly reduced our Exchange access and data management workload for tasks that we do many times every day. We now have a single console with a complete map to our ever-growing Exchange environment that has enabled our staff to identify and proactively manage and protect Exchange data.” Read the Full Announcement