0

The following below was requested in an effort to eliminate any security isses. (We are currently using the default NTLM authentication):

-Create a hidden URL extention for admin's only (new site collection)

-Add the user/password list to a SharePoint list

-Add a second form of autentication to ensure sercurity on the user/password list

I have created a new site collection with the correct site permissions. What would be the recommended way in going about the above instructions? I was thinking about possilby extending the web app and changing the authentication to something more secure such as Kerboros. Any sugesstions are appreciated!

4
  • Is this for an Extranet/Internet scenario? Commented May 10, 2013 at 15:12
  • right now its in the default zone, but if i did extend it, i would probably put it under the extanet zone. Commented May 10, 2013 at 17:13
  • I meant how is the site exposed to users. Is it only internal users that can see it or is it open to the general internet? Commented May 10, 2013 at 17:22
  • its only internal users Commented May 11, 2013 at 15:45

1 Answer 1

1

If you are questioning how secure NTLM is then I would suggest that you have far, far larger issues to worry about in your enterprise than merely the security of a list!

SharePoint's security model is pretty solid and has been tested countless times both in Intranet sites as well as Internet sites without any major failing so that should not be an issue. If you are concerned about list access itself, the list can be secured to so that only members of either a SharePoint group or an Active Directory group have access. Naturally, Site collection administrators can still see everything but if you are worried about that, then you can also enable auditing in order to keep tabs on who is accessing what and when. If you are still worried about SCA access then you can isolate the list in its own Site Collection and restrict the list of Site Collection Admins there.

A common alternative is to keep the passwords in an Excel file and then Zip that file with a password. It is not intuitive or easy to manage nor does it allow any of the standard SharePoint functionality but it does give you a second layer of security.

You also might be able to put a OneNote into a SharePoint library with the passwords and password protect it. This eliminates the utility of SharePoint list and view functions but would add the benefit of offline synchronization. This is easier than Excel but not all organizations have embraced OneNote so there is sometimes a learning, deployment or acquisition curve.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.