Microsoft Sharepoint Products and Technologies Resource Kit eBook

Chapter 24: Information Security Policies for SharePoint Products and Technologies 667
■ Required retention period for logs.
■ Information to capture when a compromise is suspected.
■ Logging required before a system can be placed in the production domain.
■ Clock synchronization on all SharePoint Products and Technologies servers
with a master clock of all servers in production domain.
■ Persons authorized to view logs.
■ Logs must be reviewed on a regular basis by authorized personnel.
Authorized Web Parts and Applications
Because SharePoint Products and Technologies is designed with a distributed
administrative architecture, it is important to remember that authorized users will be
able to install Web Parts on a site. It would be very easy for authorized users to
download Web Parts that have been created on the Internet and then install those
parts on their sites. Remember that site and portal administrators delegate the right
to add Web Parts to a Web Parts page, and there are protections in place for the
administrator to control how much a Web Part can do. Liberal delegation of this right
might lead to compromised security in your SharePoint implementation. Unsuspecting
users could download an infected or a compromised Web Part, install it, and
expose your critical information to hackers on the outside.
Because of this potential vulnerability, you should seriously consider restricting
which software can and cannot be installed in SharePoint Products and Technologies.
Points to consider when creating policies in this area include the following:
■ Prohibition against downloading third-party software to your corporate systems.
■ Requirement to scan downloaded Web Parts before use in a production system.
■ Testing for viruses must be performed on a non-cabled, stand-alone server.
■ Multiple virus screenings must be performed on all downloaded software from
the Internet to corporate systems.
■ Virus scanning software must be employed on all SharePoint Products and
Technologies systems.
■ Requirement to run all third-party Web Parts in a test environment prior to
deployment in a production environment.
Change Control
Because SharePoint Products and Technologies will be hosting some of your most
mission-critical and sensitive information, it is best to ensure that you have a strong
change control program in place for your servers. By controlling who can make