I just came across (yet another) good article by Kevin Beaver called Tests for securing the internal windows network . Kevin is an independent security expert, so he can’t be blamed for being vendor biased. Interestingly enough, the 1st step out of 3 he lists is “Test for share, directory, and (if needed) file permissions”.
Some might be surprised by this, but almost whenever I do a remote audit of file servers or a NAS devices, I always seem to find data that’s Exposed. Now, I’m not talking about an environment that’s “just” overly permissive – we all know how things work in large organizations: as people change roles or departments, they somehow always retain their old access rights and assume the new ones needed for the new role. (Why this is taking place probably warrants it’s own post). I’m talking about sensitive data being exposed to the “everyone” group (think the ‘Finance’ folder holding your company’s most sensitive data), I’m talking about seeing the “Domainusers” group showing up in unexpected places, because it’s a nested group of a nested group in Active Directory etc… If I had hair on my head, they would stand up every time we do one of these remote audits! 