Data Access Governance Best Practices - Part 2 of 2

Best Practices for File Server Permissions:

• Have users log on using domain user accounts rather than local accounts. This approach centralizes the administration of share permissions.
• Create a file server permission policy that clearly defines your permission management process.
• Remove the "Everyone" permission from every resource except the global folder designated for file exchanges.
• Assign permissions to groups, not user accounts. This approach enables you to add users to or remove them from groups without having to reassign permissions, simplifying management and improving accuracy.
• Give each group a succinct yet descriptive name to avoid errors.
• Define sets of permissions that reflect the access needs of a particular department or a specific role in the organization.
• Assign the most restrictive permissions that still allow users to perform their jobs. For example, if users need only to read information in a folder and not to change, delete or create files, assign the Read permission only.
• Organize your resources so that objects with the same security requirements are located in the same folder. For example, if users require the Read permission for several application folders, store those folders in the same parent folder. Then give Read permissions to the parent folder, rather than sharing each individual application folder separately.
• Avoid denying permissions to a shared resource explicitly. It is usually necessary to explicitly deny permissions only when you want to override specific permissions that are already assigned; this can indicate that either permissions were assigned directly rather than via group membership, or that a user is a member of the wrong group.
• Assign the Full Control permission only to the Administrators group and strictly limit membership in this group. This permission enables a user to manage application software and control user rights.
• Create a “global deny” group so that when employees leave the company, you can quickly remove all their file server access by making them members of the group.
• Audit every change to permissions on your file servers and always check whether those changes were authorized.