SharePoint Defense in Depth

A community site for SharePoint security and compliance issues

About this community

SharePoint Defense in Depth is an open community site and resource for those interested in security, defense in depth, compliance, and SharePoint. This community site provides a place to pose questions to experts, and to learn how best to tackle your SharePoint security challenges.

For access to resources including a SharePoint Content Scanner, and SharePoint Risk Assessment, please create a login. Note that to limit spam and non-useful content on this site, we require either a valid corporate e-mail domain, or a legitimate LinkedIn profile for registrants before approving access.

Our simple goal is to provide the SharePoint community with tools and resources that enable you to more effectively secure your SharePoint environments. We encourage you to engage, and post your own tips, tricks, and resource to help make SharePoint sites more secure. If you have ideas as to how we can make the SharePoint Defense in Depth site a better community resource, please contact us on:

Blog Posts

Video demonstration of the content scanner

Posted by Mike Fleck on July 18, 2016 at 9:53am 0 Comments

If you came to SharePointDefenseInDepth looking for complimentary access to the data discovery tool (Content Scanner), you can request your copy by reaching out to If you'd like to learn more about how to use the scanner and what it can locate check out this video on Vimeo. The first minutes minutes is background material so don't worry if you heard the audio but the video doesn't seem to be moving. …


Understanding file encryption in Office 365

Posted by Mike Fleck on March 8, 2016 at 12:01pm 0 Comments

In early 2015 Microsoft started rolling out per file encryption for SharePoint Online and OneDrive for Business in Office 365. Prior to that, the file encryption capability in Office 365 was simple BitLocker storage encryption. The newer approach, often referred to as Fort Knox, involved breaking files into fragments and encrypting each file fragment with a unique encryption key. Microsoft sometimes refers to this fragmenting of files as “shredded storage.” The fragment encryption keys (FEK)…


Reimagining a New Security Model for SharePoint

Posted by Peter Bradley on January 6, 2016 at 5:00pm 0 Comments

SharePoint's old security model was conceived in a different era. Let's imagine what a new security model might look like.

In my last post, we looked at the humble beginnings of SharePoint as Microsoft Tahoe, and pointed out that the security…


The free SharePoint Content Scanner is back

Posted by Mike Fleck on December 18, 2015 at 12:57pm 0 Comments

CipherPoint is once again providing free access to the content scanner.Yes, Office 365 has Data Loss Prevention but there are few reasons why you would be interested in this tool vs. the one from Microsoft.

  1. The CipherPoint scanner lets you create custom patterns to find.
  2. The CipherPoint scanner can search for sensitive content in on-premises AND Office 365 at the same time.
  3. The CipherPoint scanner is a lot easier to use.

To get the scanner you…





Take the CipherPoint's Annual State of Collaboration Security Survey

Started by Mike Fleck in General security topics Jul 14, 2014. 0 Replies

Each year, CipherPoint conducts a survey to understand businesses’ top security concerns relating to file…Continue

Government Agencies Deploying SharePoint Despite the Lack of FIPS 140-2 Level Validation

Started by K Nahbrha in Industry compliance. Last reply by Mike Fleck Dec 6, 2013. 1 Reply

How are government agencies deploying SharePoint 2010 despite the fact that SharePoint does not support FIPS 140-2 level validation as required by NIST?The operating system that hosts SharePoint must…Continue

Tags: DISA, Cryptography, NIST, 2010, SharePoint

Securing SharePoint

Started by Site Admin in General security topics Aug 16, 2013. 0 Replies

A reader posted this response to a blog we posted on the Snowden breach, and the SharePoint connection. What do you think...can SharePoint be securely deployed?JimOur blog is here:…Continue

Is anyone using RMS and SharePoint 2013?

Started by Mike Fleck in General security topics. Last reply by Kirk Hasty Jul 22, 2013. 1 Reply

One of our members just posted the above question in his status. Is anyone here using Windows Rights Management (or third party RMS provider) with *any* version of SharePoint? If so, please post your…Continue

Tags: 2013, sharepoint, management, rights

Reimagining a New Security Model for SharePoint

SharePoint's old security model was conceived in a different era. Let's imagine what a new security model might look like.

In my last post, we looked at the humble beginnings of SharePoint as Microsoft Tahoe, and pointed out that the security model really hasn't changed in the 15 years since then. Even today in SharePoint 2013 and Office 365, the basic approach to managing permissions is more or less the same:

We manually compile lists of people, then grant them permissions to stuff.

OK, so SharePoint's old model was conceived in a different era, under vastly different circumstances and hasn't much evolved. Let's try and imagine what a 'typical' organization's requirements for a brand new security model might be.

We'll stick to use cases around information management and collaboration, and avoid any specific technology. We're thinking about the enormous volumes of documents, spreadsheets and presentations, in various states of polish and approval, of various levels of sensitivity and importance, and stored in file shares and online systems.

Constant Business Change

If there is one thing that stands out about organizations in general, it is how much and how often things change. Strategies, priorities, structures, products, services, markets, people and positions. Roles, teams, departments, functions and systems appearing and disappearing. Political change. Environmental change. Economic change.

Change is so prevalent, it is possibly the only real constant!

So, our new security model has got to be designed for this. Flexibility to accommodate change, to adapt and respond swiftly when it happens - and keep information secure at all times - has got to be where we start.


Fundamentally, information security is about connecting people with the information they need, and keeping them from the information they shouldn't have. 

Permission configurations (and their deliberate absence) are the mechanism we use to connect (and separate) people and business information. Permission configurations grant or deny access for people to information. X person has Y access to Z file.

We're dealing with huge volumes of files, and many, many people. So, a typical organization may have thousands or even millions of individual permission configurations.

A business decision lies behind every single one of those configurations. Each configuration needs to be an accurate reflection of the business requirements. Accurately ensuring that the right people only have access to only the right information is how we minimise the risk of accidental or malicious internal security breaches.

But the ground under those business decisions doesn't stand still. We've already noted the prevalence of business change. A person may require access to a document today, but should not have it tomorrow. It requires constant review and maintenance in response to change. 

'Hackers' may make the headlines, but this is how the majority of security breaches actually arise: Permission configurations inaccurately reflecting business requirements which constantly change.

The scale and complexity of the challenge is immense. But hey, nobody said it should be easy!

...oh, wait...

Quick and Simple

People are busy. They have jobs to do, targets to hit, deadlines to meet. They create and use information to do what they do. When it comes to information security, and they need it to happen reliably and in the background.

So, if the tools and processes around keeping information secure aren't simple, out of people's way quickly, and largely automatic - people will find another way to get things done.


Robust and Reliable

For people to trust the systems we give them for securing their information, they need to inspire confidence. If a business user grants access to their information to a certain set of people, they need to trust that those are the people who will get that access.

There can't be any hidden back doors, or extra people they don't know about. The system has got to do what it says on the tin - no ifs, no buts, no complications.

Otherwise, users will either avoid the system because they don't trust it. Or they will use it anyway, hope for the best, then a security breach happens, the business is damaged, trust is destroyed, and those users avoid the system next time anyway.

(...ever wondered why such a common complaint about SharePoint relates to poor rates of adoption…?)


So maybe these are four fundamental requirements we can start from:

1) Accomodating constant change,

2) Accuracy,

3) Quick and Simple, and

4) Robust and Reliable.

In my next post, we'll use these basic four requirements as a lens to look at a real-world business scenario, and see how SharePoint Security stacks up.


Thanks for reading,


CEO and Principal Architect at Torsion Information Security

Views: 187


You need to be a member of SharePoint Defense in Depth to add comments!

Join SharePoint Defense in Depth

© 2020   Created by Jim.   Powered by

Badges  |  Report an Issue  |  Terms of Service