3 File Security Tricks to Protect Your Data

In the spirit of National Cybersecurity Awareness Month (NCSAM), GovDataDownload is featuring insights from industry experts about the most effective ways to keep your data safe, including best practices to implement across your organization. To achieve the highest level of data security possible, a granular perspective is needed; file security is a key building block for data and cybersecurity.

That said, implementing and enforcing file security best practices can prove to be daunting and overwhelming due to the sheer number of files needing protection within an organization. A recent blog post from Andy Green of Varonis sheds some light on the matter of file security, wherein he shares a few specific actions organizations can take to keep their file security top notch.

Here are three file security best practices he urges all organizations to implement:

1. Eliminate Everyone – Windows uses a default “Everyone” group that gives global access to a folder or file. It would make sense for companies to remove this group from a folder’s access control list (ACL), but according to the most recent annual Data Risk Report from Varonis, 58 percent of companies sampled had over 100,00 folders accessible for every employee! While you’ll need to grant everyone access if you’re sharing the folder over the network, it’s important to make sure to remove from it from ACLs and then do the following Role-based Access Control (RBAC) analysis.
2. Roll Your Own Role-based Access Controls (RBAC) – Each role in an organization has its own associated set of permissions to resources. Naturally, you assign similar roles to the same group and apply their respective permissions, and then follow AGLP method. (Accounts are organized by global groups, then into local groups, and assigned appropriate permissions.) This approach is extremely effective in maintaining file security when implemented correctly. However, the biggest hurdle here is laying the administrative groundwork to make the system successful moving forward.
3. Minimal Least Privilege Permission – This is related to RBAC, but it involves focusing particularly on “appropriate” permission. With the least privilege model, the minimum necessary access is granted to each respective role at the organization. For example, marketing may need read-only access to a folder owned by the finance department, but they shouldn’t be allowed to update a file or need access to specialized financial software. Administrators need to be ruthlessly stingy when granting permissions with this approach to keep file security at an all-time high.

Finding and enforcing a file security approach that works for your organization is an imperative foundation that fuels healthier cybersecurity best practices. Understanding how the smallest unit affects the grand scheme of data security keeps CSOs and their teams on their toes and at the top of their game.

For more information on how to protect and secure your data click here.