Microsoft Sharepoint Products and Technologies Resource Kit eBook

662 Part VII: Information Management in SharePoint Products and Technologies
plugging many security holes by prescribing acceptable behavior as information is
developed and stored.
The more an organization follows information security policies, the more
dependent an organization becomes on these rules in a host of situations, such as
guiding a manager on acceptable behavior about how information is accessed,
informing a legal team as to whether a manager has performed due diligence, or acting
as reference documents for internal security audits.
Some will say that the problem with information security policies is that the
rules are only as effective as the people who obey them. But the presence of information
security policies in an organization is fast becoming a legal assumption:
those companies that operate without information security policies (hereafter
referred to simply as policies) might be subject to the charge that reasonable care for
an organization’s information was not executed. Regardless of an organization’s size,
purpose, or location, effective information security is vital, so we are covering it in
this resource kit.
The purpose of this chapter is to outline those types of policies that should be
considered when implementing either Microsoft Windows SharePoint Services or
Microsoft Office SharePoint Portal Server 2003. Our purpose is not to write the policies
for you or even to give you a sample set of policies from which to work, but rather
to highlight the types of policies that will be affected when implementing SharePoint
Products and Technologies.
Password Policies
Because SharePoint Products and Technologies require domain services for authentication,
it is wise to have password policies in place for your network. In all likelihood,
if you have any policies in place in your organization, chances are good that
you already have policies that address the issues listed in this section. However, the
implementation of SharePoint Products and Technologies is an appropriate time to
review those policies because most of the information held in SharePoint Products
and Technologies can be compromised by obtaining a SharePoint-pervasive username
and password combination.
Like most policy domain areas, there are sub-areas that should be addressed as
the policies are written. Password policies are no exception. The following are some
of the issues to be considered when developing your password policies:
■ Minimum password length
■ Password complexity and strength
■ Prohibition of reusing old passwords
■ Prohibition of written storage of passwords
■ Prohibition against printing or displaying passwords