White Paper: 10 Things IT Should Be Doing (But Isn’t) 10 Things IT Should Be Doing (But Isn’t) Varonis Systems, Inc.1 CONTENTS OF THIS WHITE PAPEROverview .................................................1 Top Ten IT Must Do’s ........................... ... 2 Audit Data Acce ss ..................................... 2 Inventory Permissions and Directory Services Group Objects ........ ....... ........ ...... 2 Prioritize Which Data Should Be Addr essed .......................... ....................... 2 Remove Global Access Groups from ACLs (like "Everyone") .............................. 2 Identify Data Owners ................................. 3 Perform Regular Data Entitlement Reviews .................................................. ... 3 Align Security Groups t o Data ........ ....... ..... 3 Audit Permissions and Group Membership Changes................................ 3 Lock Down, Delete or Archive Stale, Unus ed Data ............................................. 3 Clean Up Legacy Groups and Access Contr ol Artifa cts....................................... ..4 10 IT Must Do’s? No Problem with Varonis .... ........................... 4 About The Varonis ®Metadata Framework™........................... . 4 Varonis ®Data Governance Suite ............5 Varonis DatAdvantage ®for W indows ........ . 5 Varonis DatAdvantage ®for UNIX/Linux .... . 5 Varonis DatAdvantage ®for SharePoint...... 5 Varonis DatAdvantage ®for Exchange .... ... 5 Varonis DatAdvantage ®for Directory Serv ices ............................. .......................5 Varonis DataPrivilege ®........................... . 6 Varonis IDU Classification Framework ®............. .......... 6 Learn More ......................................... ..... 7 10 Things IT Should be Doing (But Isn’t) OVERVIEW When it comes to protecting spreadsheets, documents, images and other data on file servers, SharePoint sites, and in Exchange mailboxes and public folders, most organizations readily admit that their current processes and risk profiles are less than ideal. Unfortunately, IT personnel – rather than the people that own the data – are the ones making many of the decisions about permissions, acceptable use, and acceptable access review. Because IT personnel aren’t equipped with adequate business context around the growing volumes of unstructured and semi-structured data, they are only able to make a best effort guess as to how to manage and protect each data set. Until organizations start to shift the decision making responsibility to business data owners, it is IT that has to enforce rules for who can access what shared data, and keep those structures current through data growth and user role changes.
