Re: Protecting sensitive files on a Windows file server

I don't want to sound like a crank here, but why would you not be able to protect these files using standard NTFS/GPO/File permissions on the files? I've got some servers with highly sensitive files on them and we've designed the permissions such that only those "need to know" are even aware that they are there, much less can actually gain access to them.

This breaks down however, if Management won't agree to this kind of forced limitation, or where the definition of "need to know" is the "everyone" group...

If someone has access to the file in order to try cracking the passwords, then there isn't much you can do to stop them, as that may require significant filesystem access as it is.

Encrypted backups help there, in case of lost media, but when it comes to windows, that nut is hard to crack. Commerical encryption may be the choice, but then again, you have to give the keys out to those that "need" to gain access to these files. If those systems are compromised, so is your Crypto.

Am I wrong here??

RandyW

paul.johnson8@xxxxxxxxx wrote:
We already have a RSA infrastructure in place (used to authenticate
our VPN). Are their any RSA authentication solutions which works at
folders/file level.

The cost to build a seperate server is prohibited at the moment.
There is a RSA Windows Agent avaliable but it only works to
authenticate Windows OS logons and not at the folder/file level.

On 21/06/06, Tyler, Grayling <ggtyler@xxxxxxxxxxxx> wrote:
The most secure is going to be the two factor from RSA but it is also
the most cumbersome to work with for the end users. Depends on just how
sensitive the files are.

All communication regarding everyday IT support needs such as IT
problems / incidents should be directed to the ITCRC team at x2848
instead of contacting the various associates directly within the IT
department.
By logging all problems / incidents with the ITCRC team, this will
provide us more visibility into the various types of calls we are
receiving, trending of these calls, numbers of calls, etc. The ITCRC
team will bring more attention to your issues and allow prompt
resolution to your calls.

-----Original Message-----
From: paul.johnson8@xxxxxxxxx [mailto:paul.johnson8@xxxxxxxxx]
Sent: Monday, June 19, 2006 7:39 PM
To: security basics
Subject: Protecting sensitive files on a Windows file server

We are looking for a secure way to store very sensitive files on our
Windows servers. The data is shared. We will turn on full auditing,
create hidden shares and a security group.

Which type of protection would be most suitable:

Office 2003 encryption
Windows EFS
Winzip 9.x encrypted archives
RSA SecurID Windows Agent (2 factor authentication)
PGP Desktop Pro

Our concern with the Windows/Office encryption types is that it could
be cracked - ie. someone could get hold of the file and run some kind
of password recovery on the file and access the data.

Any ideas on how to approach this would be much appreciated.
**************************************************************************

This electronic message may contain confidential or privileged information
and is intended for the individual or entity named above. If you are
not the intended recipient, be aware that any disclosure, copying,
distribution or use of the contents of this information is prohibited.
If you have received this electronic transmission in error, please notify
the sender immediately by using the e-mail address or by telephone
(704-633-8250).
**************************************************************************







---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

Relevant Pages

  • Re: PASSWORD
    ... It's not necessary to use encryption to limit access to a drive. ... Permissions to access folders on a drive are all that need to be used. ... Set, View, Change, or Remove File and Folder Permissions in Windows ... You can use a screensaver password to protect your ...
    (microsoft.public.windowsxp.basics)
  • Re: Backing Up
    ... encryption), and you only need backups under Windows, it looks ... would the business invest money into creating this capability? ... but thats a separate issue to whether its perfectly possible to protect against that unlikely possibility. ...
    (comp.sys.ibm.pc.hardware.storage)
  • Re: cant encrypt/turn off read-only
    ... Only Windows XP Professional has the File Encryption System. ... Protect your PC! ... | C drive itself - a filled read-only checkbox. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Folder password protection
    ... But encryption is the only thing that can protect you. ... > I am using Windows XP professional on my laptop and I am always worried ... > about my laptop gets stolen and I am wondering if its possible that I can ...
    (microsoft.public.windowsxp.newusers)
  • Re: user does not have acces privileges
    ... to reinstall the windows to do that. ... ownership is the reason of the inaccessibility. ... I'm not an expert but I find out, it is not the encryption but ... "Zorro" wrote: ...
    (microsoft.public.windowsxp.accessibility)