Solution for Security

Among the first security controls created for shared computing systems were User ID's and Access Control Lists (ACLs). Users are authenticated based on their user ID (and password), and ACLs determine whether or not they have access to a file or folder, and what actions they can perform (read, modify, etc.), enforcing the least privilege or "need to know" model. All you need to do is have the file or folder's owner dictate which users should be on the access control list. Simple, right? Well...

Flash forward some decades later, and a single terabyte of data holds tens of thousands of folders and millions of files. ACLs are usually set at the folder level; they may contain several groups, and those groups may contain from only a few to dozens of users. Still, in theory, if we make sure the folders have the right groups on their ACLs, the right people are in the right groups, and the data owners and/or group owners periodically review both, we would be in good shape, right? Well...

Unfortunately, over the years we've lost track of a few key pieces of information: we don't know the owners for many of those folders, we don't know which groups are on which ACLs, we don't know if the right people are in the right groups, and we have about as many groups as we have employees. To make matters worse, we don't know who is actually accessing file system data because native auditing is so resource intensive that it cannot be enabled.

You're not alone. According to a study by the Ponemon institute, 91% of organizations have no process to identify data owners. The same study found that 76% of organizations can't reliably determine who has permissions to access a folder—determining who is in each ACL's groups and the groups within those groups can be pretty painstaking.

In a nutshell, most organizations aren't able to verify that its ACLs are configured on a need-to-know basis, and they have no audit trail to fall back on. In audit speak, we can't tell if the preventive controls (ACLs) are properly configured to limit access to the correct people, and we have no detective control to determine if improper or unwarranted access has taken place.

Varonis addresses these security concerns by providing a software framework that enables customers with unstructured and semi-structured data residing on their Files Systems, SharePoint Sites and NAS devices to audit data access activity, fix and maintain access controls, identify sensitive data, find data owners, and involve them in access review and authorization processes.