Real-World SharePoint Information Governance A Case Study

Transcription

1 October 28, 2017 WELCOME SHAREPOINT SATURDAY OTTAWA Real-World SharePoint Information Governance A Case Study Antonio Maio Antonio.maio@protiviti.com Blog: Slide share:

2 Thank you Sponsors!! Platinum Gold Silver Bronze Breakfast SharePint

3 Information Governance Information Governance means setting out the structures, people, policies, procedures and controls necessary to manage information and support an organization's immediate and future requirements -Wikipedia

4 Standards for Managing and Using Information Immediate and Future Requirements Define Roles & Responsibilities Document End User Needs Regulatory Compliance Requirements Legal Department Requirements (Records, ediscovery, legal hold) Risk Management & Mitigation Administrative Needs Environmental Needs Operational Needs and on and on

5 Developing a SharePoint Governance Plan Key Areas to Focus Confidential Define Information Architecture/Structures (Includes Metadata Taxonomy) Define Roles, Responsibilities, Authority Define Rules for Site Creation, Management, Decommissioning Determine Training Needs; Plan to Educate User Community Define Security Groups, Permissions & Roles for Assigning Permissions

6 So you have a plan! Now what?

7 Governance is really about Organizational Change

8 Planning, Thought, Creativity Hard Work

9 1 Information Governance Case Study OIL AND GAS

10 Client Profile: Oil and Gas Industry Houston based 3500 Employees Fortune 70 Company Heavily Regulated: PHMSA, DOE, DOT Most Sensitive Information: Human Resources Data Salaries, Bonuses, Stock Grants

11 Information Governance Journey Going thru Enterprise-wide SharePoint 2013 migration Building department based site collections Security was top of mind They equated good security with good information governance Other drivers: records management, versioning, roles Executive Sponsorship: VP of Information Services Enterprise Migration to SharePoint 2013 Information Governance Process

12 Information Governance Journey Governance Committee Define Vision & Goals Establish a SharePoint Governance committee or working group Define leadership and ownership of the overall ECM vision for the organization Establish a meeting cadence & define a vision, with goals & objectives Define a charter with committee responsibilities Roles & Responsibilities Define the roles & responsibilities related to the design, administration & adoption of the ECM environment Including executive, technical/administrative and business leadership roles Direct usage and growth of SharePoint within the organization

13 Information Governance Journey Site Architecture, Configuration & Processes Define overall SharePoint site structure for the organization Include site owner responsibilities Site monitoring, decommissioning and management processes Operational and IT Administration Identify operational & IT management processes Include maintenance, disaster recovery, backup and storage needs Define permissions required for each IT role Content Management & Regulatory Compliance Define & identify processes for content management Records management, retention, archiving Requirements to meet regulatory compliance standards within SharePoint Social Collaboration Define usage of personal sites, newsfeeds, blogs, and social collaboration tools like Yammer

14 Information Governance Journey Security & Controls Define security and monitoring controls Include farm level controls, user authentication, authorization/permissions, security policies, identity management, automated monitoring/alerts, access to content, etc. Training Identify immediate and ongoing SharePoint training needs for diverse audiences Include end users, power users, site owners, administrators Include specialty areas like Business Intelligence, Responsive Design and building Workflow processes. User Adoption Define & identify needs for increasing SharePoint user adoption Include topics like good user experience design, a robust information architecture and clear role/ responsibility definition

15 Using Information a SharePoint Governance site, OneNote and Site the Protiviti & Information Notebook Governance Template, allows stakeholders to actively participate in developing the information governance plan.

16 Information Governance Site & Notebook Develop goals & objectives, vision, form the governance committee, develop governance committee charter with responsibilities + tactical meeting details.

17 Identify Information roles and responsibilities, Governance environmental structure, server Site configuration & Notebook and operational concerns, authentication & analyze support structure, etc

18 Identify Success roles and responsibilities, Criteria environmental and structure, Outcomes server configuration and operational concerns, authentication & analyze support structure, etc Timing was critical Occurred during Enterprise-Wide SharePoint Migration Business departments are already engaged Heavy IT involvement when implementing the plan Provide training, implement controls, automate through workflows, work with business groups, regular security reviews Organizational change occurred one department at a time manageable Centralized permission management and site creation Planning Process was very interactive SharePoint Site & OneNote allows us to develop the plan during committee meetings Defined data owners for each department Defined permission monitoring and regular re-certification process Defined/communicated responsibilities

19 Still had to produce that document! Information Governance Plan

20 2 Information Governance Case Study FINANCIAL SERVICES

21 Client Profile: Financial Services New York based 4000 Employees Fortune 700 Company SEC Regulated Most Sensitive Information: Material Non-Public Information (MNPI) Information is material if there is a substantial likelihood that a reasonable investor would consider it important in deciding whether to buy, hold or sell a security. Information is non-public if it has not been publicly disclosed.

22 Information Governance Journey SEC Audit Findings related to access control on file shares and sites, specifically for MNPI data 2200 Fileshares and 1600 SharePoint Sites Permissions management was delegated to business users Already had a SharePoint Governance Plan Didn t apply to those file shares and sites Executive Sponsorship: Head of Compliance Remediate the security issues Take measures to prevent issues in the future and do it all within 3 months

23 Step 1: Identify Data Owners Gathered list of File Shares and Sites Reporting to determine obvious ownership Result: 400 file shares or sites claimed (approx. 200 file shares, 200 sites) Ensure always have 2 data owners for each Work directly with data owners to review and certify permissions Get documented confirmation of review/certification What about the remaining 2000 file shares, 1400 sites?

24 SharePoint Site to Claim Ownership Make it Easy! Views to Review My Validations (claims I ve submitted) Make it Easy! Calculated Column, Content Editor Web Part & JavaScript to Auto-Populate Claim Form Make it Easy! Use the right language for your business users. Provide an FAQ 10,018 Ownership Claims (7400 in first 5 days)

25 Step 2: Identify MNPI Material Non-Public Information (MNPI) Information is material if there is a substantial likelihood that a reasonable investor would consider it important in deciding whether to buy, hold or sell a security. Information is non-public if it has not been publicly disclosed. Cannot be automated Make it part of the claim form: Does this site contain MNPI? No default answer, but provide options: Yes, No, Uncertain If there is any doubt, assume it does contain MNPI

26 Step 3: Review and Certify Permissions Data owners must review permissions and either: Certify they are correct (provide that they certify) Make changes and then certify Request help to make changes and then certify Give them a deadline Check up regularly Make sure have some senior pressure to get it done Document the process heavily

27 Step 4: Shutdown Sites Not Claimed/Certified Pick a date - Give plenty of warning! File shares are easy add a deny permission Site Collections are easy implement the lock feature Sites/Subsites are not easy remove all permissions recursively

28 Step 4: Shutdown Sites Not Claimed/Certified Scripted the SharePoint permission removal process with PowerShell As part of the script, documented permissions before removing them Be Prepared for Backlash Will help to define data owners Define a process by which you can restore permissions if needed give business an SLA (sites will be restored within 6 hrs, 12 hrs, etc.) Script process to restore permissions Document what you restore

29 Step 5: Implement Governance System Implement a third party application to centralize requests for access to information File shares and Sites Approvals requested of individual s manager and data owner Access granted automatically once approvals received Perform permission recertification every 6 months Automate notifications & reminders to data owners going forward of recertification activities All access requested/granted/denied is monitored and logged

30 Success Criteria and Outcomes Top level support Mandate from Head of Compliance to get it done! All file shares and sites remediated, except 76 file shares and 90 sites Process driven by InfoSec team Supported by SharePoint Administration team Started with Data owners Organizational change started from data owners Defined permission monitoring and regular recertification process Defined/communicated responsibilities

31 Closing Going through an Information Governance planning process is important Organizational change is critical! Consider how organizational change happens in your organization Consider data ownership as a method of kick starting the process Who owns (or is responsible) for different types of data Owners understand their responsibilities Owners understand and periodically review access to their data Consider a permission monitoring and regular permission recertification process

32 Sponsored By Salon pm Please drink responsibly. We will be happy to call a cab for you

33 Thank You! Antonio Maio Blog: Slide share:

34 Appendix Claim Site JavaScript Select the list From the Ribbon click on Form Web Parts Select Default New Form Click on Add a Web Part Select Media and Content Add the Content Editor Edit the Content Editor web part and give it a link to the JavaScript file Place the following JavaScript in the Site Assets library [javascript] < script type="text/javascript" src="../../javascript/jquery min.js"></script> < script type="text/javascript"> // Get al the field names from the form fields = init_fields(); // Get all querystring parameters from the URL var querystr= getqueryparameters(); // Is the parameter "FileShareID" defined - if so then auto-assign the value from the URL to the field on the form if(querystr[ FileShareID ]!=undefined) { var properval = decodeuri(querystr[ FileShareID ]); $(fields[ FileShareID ]).find( input ).val(properval); } // Is the parameter "ShareName" defined - if so then auto-assign the value from the URL to the field on the form if(querystr[ ShareName ]!=undefined) { var properval = decodeuri(querystr[ ShareName ]); $(fields[ ShareName ]).find( input ).val(properval); } // Is the parameter "UNCPath" defined - if so then auto-assign the value from the URL to the field on the form if(querystr[ UNCPath ]!=undefined) { var properval = decodeuri(querystr[ UNCPath ]); $(fields[ UNCPath ]).find( input ).val(properval); } // Retrieve all of the parameters passed on the URL function getqueryparameters() { qobj = {}; var urlsearch = window.location.search; if(urlsearch.length>0) { var qpart = urlsearch.substring(1).split( & ); $.each(qpart,function(i,item) { var splitagain = item.split( = ); qobj[splitagain[0]] = splitagain[1]; }); } return qobj; } // Retrieve all the internal field names on the form function init_fields() { var res = {}; $("td.ms-formbody").each(function() { if($(this).html().indexof( FieldInternalName=" )<0) return; var start = $(this).html().indexof( FieldInternalName=" )+19; var stopp = $(this).html().indexof( FieldType=" )-7; var nm = $(this).html().substring(start,stopp); res[nm] = this.parentnode; }); return res; } < /script> [/javascript]