Solution for UNIX/Linux

The Varonis Solution

Varonis^® DatAdvantage^® addresses these challenges by aggregating Active Directory user and group details, ACL information and all data access events—without requiring native OS auditing—to build a complete picture of who can and who is accessing data, and who should have their access revoked. It also leads IT to rightful data owners, so the right people can ensure appropriate access and usage.

Why is this challenging?

UNIX: Permissions

On any given day, determining who has access to a directory isn't exactly easy, especially if groups on the folder's ACL contain one or more nested groups in LDAP, NIS, or even Active Directory. Determining which folders a given group provides access to requires at least a shell script that can enumerate both permissions and groups in LDAP, NIS, or /etc/groups. Determining who should and should not have access to any directory is simply impossible without automation.

Traditional UNIX style permissions only contain masks for one owner, one group, and the rest of the world. In order to grant multiple users and groups to a file or directory's ACL, POSIX ACLs were created. Unfortunately, unless you're in the habit of modifying these every day, you may end up running "man setfacl" a lot in order to use them with their command line switches. A common graphical interface is needed so that POSIX ACLs can be implemented efficiently and effectively across the enterprise.

UNIX: Auditing Challenges

More than 95% of file access activity is not audited by IT. Why? BSM in Solaris is resource intensive and difficult to decipher, so it is rarely enabled. Linux didn't have native kernel auditing until 2.6, and it suffers from the same barriers of other auditing subsystems. The result is that IT cannot answer fundamental questions like, "Who changed /etc/passwd? Who has been accessing my folder? Who deleted my data? What data has this person accessed?"

UNIX: Operational Challenges

Most permissions and group membership changes are performed manually and are untested prior to execution. Cleaning up world-writable files and folders is especially difficult. Without access auditing, IT needs to make a guess as to which users and applications access a data set, manually effect the changes, and hope they don't get a call from an end user that can no longer access data they require to do their job, or an administrator who is panicking because their application is no longer functional.

UNIX: Data Ownership Challenges

Organizational data owners should be making decisions about who gets access to their data and its proper use—not IT. Yet, 91% of organizations lack processes for determining who owns a given data set. Without a data owner that understands the sensitivity, importance, and organizational context, data cannot be managed and protected by the right people.

UNIX: High Risk

It is difficult to identify excessive permissions; remediating excessive permissions without disrupting organizational processes is even more difficult. As a result, access to data is rarely revoked. Excessive permissions and the lack of an audit trail leave data at risk for loss, theft, tampering and misuse—with no way to determine what happened after the fact.