Microsoft Sharepoint Products and Technologies Resource Kit eBook

664 Part VII: Information Management in SharePoint Products and Technologies
single sign-on policy. If your organization prohibits single sign-on capabilities, meaning
that users must log on to each application that requires unique authentication, you
will be unable to use the single sign-on feature in SharePoint Portal Server 2003.
Also, the Active Directory Mode feature of Windows SharePoint Services needs
to be considered in a Windows SharePoint Services–only installation. Given that this
feature allows site administrators the ability to create new user accounts in Active
Directory, if you are going to use this feature, you should have policies surrounding
who can be a site administrator and under what circumstances a new user account
can be created in Active Directory from a Windows SharePoint Services site.
In addition, if you are going to use SharePoint Products and Technologies in an
extranet environment—especially for its customer relationship features—in which
users outside your company will be authenticating in your domain to access their
portion of the portal site, implementation of a policy specifying how you will
securely transmit passwords to those users and whether or not e-mail may be used
will have paramount importance.
Moreover, in situations in which you will be sharing sensitive information with
other companies (maybe even competitors), you will probably want a robust set of
password policies to be required by all parties to the agreement, necessitating the
development of such policies before the project can begin.
As we mentioned previously, much of the information in SharePoint Products
and Technologies is secured only through username and password combinations. The
compromise of passwords in your environment could lead to sensitive information
being exposed to the wrong people and this, in most cases, would be disastrous.
Personal Use of Sites
We would like to think there is no need to mention this, but it is possible that users
will create their own websites, give only themselves permission to the site, and then
use that site for private purposes. The authors of this resource kit know of multiple
times when a company’s servers were used to set up Internet-based businesses without
the knowledge of or the consent of the company’s owners.
Creating policies that prohibit personal use of company systems will help prevent
this problem. Few things irritate system administrators more than the misuse of
company systems for personal gain at the expense of system performance, storage
space, and additional administrative effort.
Because it will be very easy—especially for the SharePoint Products and Technologies
administrators—to set up personal websites (we are not referring to the My
Site feature here, but rather to rogue Windows SharePoint Services sites) for personal
gain (if you have enabled Self-Service Site creation or if the user is already a
member of the Administrator site group in a site), a strict prohibition should be
approved by your managers and then communicated to your users as part of their
SharePoint Products and Technologies training.