Microsoft Sharepoint Products and Technologies Resource Kit eBook

Chapter 24
Information Security
Policies for SharePoint
Products and
Technologies
In this chapter:
Password Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662
Personal Use of Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 664
Information Storage Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665
Administrative Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
Logging Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
Authorized Web Parts and Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . 667
Change Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
Information Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668
Data Classification Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 669
Extranet Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670
In today’s world, you cannot really secure a network without having information
security policies in place. Such policies are really business rules—rules that define
acceptable and sometimes required behavior regarding your company’s information.
Information security policies continue to become more complex because the technologies
that host an organization’s mission-critical information are also becoming
more complex every year, if not every month. From cell phones to laptops, from
PDAs to servers, the access vectors and potential security holes are increasing as the
technology complexity increases. Information security policies are one method of
661