File server security remains a priority for organisations that retain on-premises storage alongside cloud-based services, with access governance at the centre of efforts to protect sensitive data.
Despite continued migration to software-as-a-service platforms, many businesses are maintaining traditional file servers because they offer predictable local storage costs, control over data and backups, support for legacy systems, and fewer concerns about ownership and data sovereignty.
Hybrid IT environments, combining local infrastructure with cloud applications, can also help organisations meet regulatory and retention requirements. But the arrangement leaves administrators with the demanding task of ensuring that employees have access only to the information they need.
Use groups rather than individual permissions
The first principle is to avoid assigning access directly to individual users. Instead, administrators should create dedicated security groups for particular resources and permissions, using a clear naming system such as fs_finance_read.
That approach makes access easier to understand and audit. A user’s group memberships provide a practical record of the folders and permission levels available to them.
Direct permissions are much harder to identify. They may be visible only in the properties of the relevant folder, meaning that administrators can overlook one-off access arrangements even in relatively small file-server environments.
Although urgent requests from managers can make direct assignment tempting, such exceptions can become difficult to track when staff change roles or leave the organisation.
Adopt a role-based structure with nested groups
Users should not necessarily be added directly to every resource group either. A more manageable structure separates a person’s organisational role from the permissions attached to a particular file share.
Under the commonly used AGDLP model, accounts are placed in global groups representing roles such as sales, human resources or customer support. Those groups are then nested inside domain-local groups that control access to specific resources.
New starters can consequently receive the permissions associated with their jobs by joining the appropriate role group, rather than being granted access to a long list of individual folders. When responsibilities change, administrators can alter the user’s role membership instead of reviewing every resource separately.
The model is intended to provide a form of role-based access control for file servers and wider Active Directory environments, while reducing the scope for inconsistent permissions.
Let NTFS permissions do the detailed work
Network share permissions and NTFS permissions operate together, with the more restrictive result taking precedence. Administrators can therefore keep share permissions relatively broad and use NTFS controls to apply the detailed restrictions.
A typical arrangement might give users Change access at the share level and administrators Full Control, while more precise read, write and modify rights are set through NTFS. NTFS permissions also apply to local access, rather than only connections made across the network.
Keeping the two systems aligned and using each for its intended purpose can make a file server easier to administer than attempting to build a complex set of restrictions at the share level.
Preserve permission inheritance
Permissions are generally easier to manage when they are set near the top of a carefully planned directory structure and inherited by folders and files below. Administrators should avoid creating explicit exceptions deep within the tree wherever possible.
In practice, old folder structures and demands for access to individual project directories can make this difficult. Breaking inheritance for a single folder may create further complications for its contents and make future reviews harder.
Where feasible, a project folder should instead be moved higher in the structure or placed in a new location designed around its access requirements. The aim is to keep explicit permissions to a minimum, ideally no more than two or three levels below the top of a directory tree.
Apply the principle of least privilege
Access should be limited to what an employee needs to perform their work, with the lowest permission level that allows the task to be completed. Someone who only needs to view documents, for example, should not automatically receive the ability to change or delete them.
Least privilege is not a one-off exercise. A permission that was appropriate when it was granted may no longer be justified a month, quarter or year later as staff move between roles and projects end.
Regular access reviews are therefore needed to identify and remove rights that no longer serve a purpose. Manual checks can become impractical as the number of users, folders and cloud services grows, particularly when administrators have no central view of how access has been granted.
Tenfold Software, which sponsored the guidance, says governance platforms can assist with provisioning, approval processes, group administration and recurring access reviews. Its platform is also designed to show why a person can reach a particular directory and to manage permissions across local file servers and cloud applications.
The underlying principles apply regardless of whether a business plans to keep its file servers indefinitely or eventually move more data to the cloud: permissions should be visible, linked to business roles, regularly reviewed and removed when they are no longer required.
