1. Introduction

The misuse of user privileges is one of the main sources of a data breach within an organization and so appropriate action must be taken to keep the risk of these threats to a minimum. One such threat is being unaware of the files and folders that users have access to via open shares.

Organizations allow open shares on their systems to make it easy for end-users to have easy access to a given resource. However, if these open shares are not managed correctly, they can create security risks with potentially catastrophic consequences.

The focus at Lepide is to provide visibility over what’s happening with your network and through visibility you can take the necessary steps to mitigate risk and stay compliant. Once you have visibility over open shares within your network it is a straightforward process to take action to manage the access to them.

2. What is an Open Share?

An open share is a resource where access is unrestricted to most end users and is achieved using Open Access Groups. These types of groups can include:

Everyone – all users and accounts that have authenticated to the system.

Authenticated Users – everyone except build-in, non-password protected groups.

Anonymous Logon – a built-in group that enables users to access resources from an anonymous account.

Domain Users – a default group within Active Directory to which users accounts are automatically added.

3. The Effect of Open Shares on Data Security

Open shares are especially problematic when dealing with resources that contain sensitive data, such as Personally Identifiable Information (PII), Protected Health Information (PHI) and Payment Card Information (PCI), as it makes it a lot easier for hackers to gain access to this data.

There are times when it is necessary to have resources that are accessible to all users on a network for example calendars, press releases, job descriptions and marketing materials and so on, but it only takes one employee who has been wrongly granted write-access to a resource to result in a serious security incident.

A lot of malware and viruses are designed to spread using open shares. A hacker may obtain a legitimate set of credentials and if they have been granted full write-access to the resource in question, they could use those credentials to infect the resource with malware.

4. Access Governance

Access Governance is the process of monitoring and controlling who within an organization has access rights and ensuring that users only have access to those functions that are essential to do their job. The need for access governance has become more evident as organizations seek to remain compliant and to manage risk with a more strategic approach.

Within the process of monitoring all network user privileges, it is essential that open shares are reported on regularly as if they are not managed correctly, they can become a significant threat to network security within an organization. Without Access Governance processes in place, access to files and folders via an open share could be used by an attacker to gain access to the network and cause a data breach.

However, while the constant monitoring of open shares is achievable, it can be complex and time consuming without the right solution in place.

5. The Lepide Solution

The Lepide Data Security Platform provides a complete solution that scans and reports on all open shares within an organization.

By first running a scan and then running the All Shares Report, it is possible to identify all open shares and then to take action to manage how they are being used.

5.1 Running a Scan

The Find All Shares scan needs to be run before the report can be generated and the steps to do this are from the Legacy Console and are as follows:

• From the Legacy Console main screen, click on the Settings icon

  

• From the tree structure on the left-hand side, click on Current Permission Scan Settings

The following screen will be displayed:

Find All Shares

• Click the Find All Shares button and a wizard will start. The Domain Credentials dialog box will be displayed:

• Add the Domain Credentials and click Next to continue

The Map the Computer IP address dialog box is displayed:

• All Computer names will be selected. De-select any that you do not want to be included in the scan

• You can also schedule the scan to happen weekly by choosing a day and time for the scan in the Schedule section of the dialog box

• Click Finish

5.2 Running the Open Shares Report

Once a scan has run, the Open Shares Report can be generated from the Lepide Web Console as follows:

• From the Web Console Home screen, choose Lepide Trust

• The Lepide Trust reports are displayed:

• From the tree structure to the left side of the screen, expand Risk Analysis to see the Open Shares Report:

•  Click on the Open Shares Report from the tree structure

  The empty Open Shares report is displayed:

• Click Generate Report

 The Open Shares Report is displayed: