Policy for Web Applications’ Firedrill
‘Help! All of a sudden, all users can view all (including private) content in SharePoint.” … Never the good start of a conversation (especially on a Friday afternoon!). Here’s the deal – Users are reporting open access to once private information in SharePoint. Assessment of the SharePoint site security page shows that these users are not listed with any rights… but they still have gained access. It’s as if they have been granted super powers. How?
In Central Administration, there is a section called ‘Policy for Web Applications’. It is intended to allow administrators granular security management to allow (or deny) specific rights to a user or group across all sites in a web application. This is a very powerful (and dangerous!) capability. In this case, support from a not-to-be-named-large-product-company advised the setting of ‘read all’ to all authenticated users. What this does is give everyone read rights to everything, including sites with non-inherited security… and this is NOT noted in the site permissions list. This is like having 8 locks on your front door and leaving the back window open (with a stool propped to let people in and bags on the floor to help them carry your valuables away!).
Morals of the story here are: (1) understand that even the tightest security models can be compromised with the same tools intended to help protect (2) be very careful about what changes you allow in your production environment and ensure that any related to security are justified, tested, and documented.