WHITE PAPER

Microsoft SharePoint is a widely adopted data-sharing and collaboration platform that is often extended using third-party software. When the data in SharePoint is sensitive and regulated, the security of the platform—as well as the software extensions—must be a top concern for organizations.

Seventy percent of organizations are facilitating cross-functional collaboration and increasing productivity by using Microsoft SharePoint as an intranet, extranet, and to host public websites1. This means business-critical data, including regulated or sensitive information, is stored in most SharePoint environments. In parallel, companies are leveraging third-party add-ons within the SharePoint platform to get their deployment off the ground, encourage adoption, and increase employee interaction. This paper will discuss the threats introduced when using third-party SharePoint plug-ins and Web Parts, evaluate the effectiveness of traditional security solutions in respect to these threats, and provide recommendations for hardening SharePoint systems.

What Organizations Store in SharePointIn an Industry Watch report survey conducted by independent research firm Association for Information and Image Management (AIIM), results concluded that SharePoint is highly integrated into companies, especially when compared to most other enterprise IT systems. The report stated that “…over half of respondents are deploying a single SharePoint system across the full enterprise”, indicating that SharePoint is becoming an enterprise-wide, “highly integrated” system2, and not just a tool used in pockets of the organization.

DID YOU KNOW?

Business-critical data, including regulated or sensitive information, is stored in most SharePoint environments.

1. David Jones. “The SharePoint Puzzle—adding the missing pieces.” AIIM.2. David Jones. “The SharePoint Puzzle—adding the missing pieces.” AIIM.

Protecting Against Vulnerabilities in SharePoint Add-ons

2

The principal reasons organizations implement SharePoint are internal collaboration, content management, project management, records management, corporate intranet, and as a replacement for file shares3. These uses are core to running a business and imply that groups and individuals store a multitude of files with sensitive or regulated data in SharePoint. For example, consider whether the information below is stored in your company’s SharePoint deployment:

• Regulated data. Personally identifiable information (PII), credit card information, personal health information (PHI), and financial records.

Organizations operating in highly regulated industries, such as the Healthcare, Financial Services, and Federal sectors, commonly leverage SharePoint as a file repository and extranet portal. HIPAA, FINRA, PCI DSS, ITAR and SOX regulations are some of the primary motivators for organizations to ensure that data of this nature is not breached.

• Sensitive data. Intellectual property, deal data, competitive information, business plans, and legal information.

The data that an organization considers to be the most sensitive is not always evident, especially if IT teams, rather than data owners, are determining how information is to be classified. As an example, take an international retailer with store operations plans and strategies stored in SharePoint. While one business unit might assume this data is the most critical to the organization’s success, management and the Board of Directors may consider the data pertaining to its international expansion strategy to be top of mind.

SharePoint Starts SmallCompanies typically implement SharePoint in a progressive manner, starting with an intranet for file sharing and content management, and eventually expanding to externally-facing deployments. Extranets are often used as a portal for customers, partners, employees, or alumni and commonly for a Board of Directors site. The later versions of SharePoint, such as SharePoint 2013, offer new functionality for simple and low-cost website creation, leading a number of Fortune 500 companies to create corporate websites, microsites, and e-commerce sites with SharePoint.

As more applications are created in SharePoint, and new data is made available to those accessing SharePoint, the risk of exposure increases. The introduction of third-party widgets exacerbates the situation. According to AIIM, more than half of organizations implementing SharePoint use or are: “…planning to use third-party add-on products in order to enhance functionality. Only a third thinks they will stick with the vanilla product.”4 In addition to individual components, many organizations outsource SharePoint application development entirely. With almost thirty percent of all applications being produced by third parties5, organizations need to evaluate the security of SharePoint applications given the amount of regulated and sensitive information dispersed across the platform.

WHAT INFORMATION IS STORED IN YOUR SHAREPOINT DEPLOYMENT?

Regulated Data

• Personally identifiable information (PII)• Credit card information• Personal health information (PHI)• Financial records

Sensitive Data

• Intellectual property• Deal data• Competitive information• Business plans• Legal information

More than half of organizations implementing SharePoint use or are: “…planning to use third-party add-on products in order to enhance functionality. Only a third thinks they will stick with the vanilla product.”–AIIM 2012

3. David Jones. “The SharePoint Puzzle—adding the missing pieces.” AIIM.4. David Jones. “The SharePoint Puzzle—adding the missing pieces.” AIIM.5. Veracode State of Software Security Report, Volume 4

3

Why Organizations Use SharePoint Plug-ins and Web Parts “Many would argue that the sheer volume of third-party add-ons highlights that SharePoint is nothing more than a Swiss army knife: a platform that requires users to plug-in “industry-strength” tools from external suppliers in order to achieve the performance, functionality and robustness required.” 6

Microsoft SharePoint without plug-ins or Web Parts can be compared to an iPhone without apps7. While consumers use apps for convenience, ease-of-use, collaboration, and productivity, it’s for these same reasons that IT teams will look to third-party SharePoint widgets to directly modify the content, appearance, and behavior of SharePoint site pages8. Some of the most popular categories9 of SharePoint plug-ins and Web Parts include:

• Forms. These widgets enhance the feature set of SharePoint forms, allowing admins to customize and create forms more quickly.

• Document Management. As one of the most common use cases for SharePoint, organizations leverage this category of add-ons for better distribution of documents throughout teams or groups; increased organization of documents; template customization; enhanced SharePoint search capabilities; and more.

• Productivity. Productivity plugins make tasks easier for employees, enabling them to be completed more quickly.

Additionally, there is business justification for IT teams to put third-party tools in place; this can also be referred to as a “no-code” strategy for SharePoint. First, there is significant cost and time associated with custom coding projects within the platform. Stakeholders and end-users are interested in getting SharePoint deployments off the ground and seeing employee adoption. Third-party tools enable exactly that, e.g., the ability to deliver in-depth workflows within a matter of days versus weeks. While administrators can experience quick wins with external products, incorporating third-party code alongside regulated and confidential data presents a serious and wide reaching security risk to SharePoint intranets, extranets, websites, and also their end-users.10

PLUG-IN AND WEB PART DEFINED

Plug-in (a.k.a. extension): A software component that adds additional functionality to the larger SharePoint system

Example: SharePoint Outlook Integration

Web Part (a.k.a. web widget): A stand-alone application that is embedded into SharePoint, and which pulls in useful information from other websites

Example: Twitter feed

6. David Jones. “The SharePoint Puzzle—adding the missing pieces.” AIIM.7. Francis Brown. “SharePoint Security: Advanced SharePoint Security Tips and Tools.” Stach & Liu, LLC.8. “Creating Web Parts for SharePoint.” Microsoft.9. “Top 50 SharePoint Plug-Ins and Web Parts for 2013.” Portal Front.10. “The ‘No Code’ SharePoint Strategy.” PointBeyond Ltd.

4

Risks Associated with SharePoint Plug-ins and Web PartsPractically every SharePoint web application includes components that were not developed by in-house application programmers. Even if an application were to be completely homegrown, the web server and operating system were almost certainly coded elsewhere. According to Veracode, about seventy percent of internally developed code originates outside of the development team11. In many cases, developers aren’t aware of all application components they are using, not to mention their versions. From a business standpoint, SharePoint administrators and security teams should always assume that third-party code—coming from partners, vendors, mergers, and acquisitions—contains significant vulnerabilities.

Moreover, organizations have no control over fixing weaknesses in code they do not own. Not only are organizations blind to vulnerabilities when implementing third-party Web Parts and plug-ins, but they will not be protected until that third-party addresses those vulnerabilities. These security gaps transform add-ons from useful SharePoint tools into vehicles for delivering malware and technical attacks. If a vulnerable component is exploited, such attacks can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities have the ability to undermine application defenses and introduce a range of possible attacks and business impacts.

The Latest Addition to the OWASP Top 10Concerns around third-party applications are of such concern that the Open Web Application Security Project (OWASP), an industry group focused on web application security best practices, added this threat to its most recent Top 10 report. The Top 10 report represents the most critical web application security risks as identified by a broad consensus of application security experts around the world. This addition is the main difference between the previous OWASP Top 10 and the 2013 Top 10.

This new OWASP Top 10 threat not only reinforces the popularity of third-party components in application development, but also underscores the risks introduced by these components. Because thousands of SharePoint instances may include the same vulnerable code, attackers are highly motivated to locate and exploit vulnerabilities in these application components. It’s likely that this is why many of today’s high profile breaches are caused by vulnerable third-party components.

SHAREPOINT SECURITY TIP

SharePoint administrators and security teams should always assume that third-party code—coming from partners, vendors, mergers, and acquisitions—contains significant vulnerabilities.

SHAREPOINT SECURITY RISK

Applications using components with known vulnerabilities have the ability to undermine application defenses and introduce a range of possible attacks and business impacts.

11. Veracode State of Software Security Report, Volume 4

5

Hacking and the Rise of CMS HackingCyber attacks are motivated by a number of reasons—whether they are performed by profit-driven industrialized hacker groups; by hacktivists looking to target organizations based on ideology or personal agendas; or by government entities seeking economic or political gain.

Depending on the motivation, hackers might focus on exploiting one particular organization, as demonstrated in the December 2012 attack on Yahoo! in which a hacker exploited a third-party astrology web application and successfully gained full access into the company’s Microsoft SQL database. Other motivations might inspire “mass hacking” in which malicious groups or individuals identify vulnerabilities in content management systems (CMS) and where the same principals apply. SharePoint, one of the leading CMS systems, is built using mainly Visual C#, Visual Basic, the Microsoft .NET Framework, ASP.NET, HTML/CSS, Document Object Model, and Silverlight, it integrates with Active Directory, and is designed for use with Microsoft SQL Server and Internet Explorer12. As a result, the system contains its share of potential security challenges.

Microsoft has reported nearly 300 vulnerabilities in SharePoint Server and related products since its release in 2001, which have rendered the underlying software subject to attacks such as cross-site scripting (XSS), SQL injection (SQLi), directory (or path) traversal, and remote file inclusion (RFI)13. While classic website hacking consists of a single site attack in which cybercriminals identify the target, find a vulnerability, and set out to exploit it, CMS hacking, where one CMS vulnerability has the ability to compromise thousands of organizations, is on the rise.

“Microsoft addressed a zero-day flaw and nine other vulnerabilities in SharePoint that could allow remote code execution… In addition, the server has two cross-site scripting vulnerabilities that can be used by an attacker to carry out attacks and run malicious scripts while masquerading as the logged-in user.”14 – Robert Westervelt on critical security updates in Microsoft SharePoint, September 2013

Intricacies of a Third-Party Code ExploitThis section explores how an exploit takes place via SQL injection (SQLi), a very common data extraction technique with the objective to retrieve sensitive data, steal site admin credentials, or infect an end-user with malware. Even after a decade of web application development and awareness around web application security, this attack method is still very relevant and continues to play a major role in application hacking. This is demonstrated by the fact that SQLi has become highly automated and can be performed by unsophisticated hackers with the assistance of hacking tools like SQLmap and Havij.

On-demand Webinar

CMS Hacking 101Content Management Systems

(CMS), like SharePoint, expose

organizations to a new set of

vulnerabilities. This presentation

shows how malicious hackers

exploit vulnerabilities found in

CMS to systematically identify

and attack unsuspecting

organizations and provides

recommendations for attack

protection.View Webinar

12. Gustavo Garcia. “SharePoint: In Defense of Cross-Site Scripting.” 13. Gustavo Garcia. “SharePoint: In Defense of Cross-Site Scripting.”14. Robert Westervelt. “Patch Tuesday: Microsoft Fixes Critical Outlook Error, Critical SharePoint Flaws.” CRN.

6

Anatomy of a SQL Injection AttackHackers begin by taking advantage of non-validated input vulnerabilities in which unchecked user input is transformed into database queries. Cyber criminals use a variety of approaches to identify application weaknesses. First, they may search public vulnerability databases, which contain thousands of web application and CMS-related vulnerabilities. Another option is to perform Google searches for weak or exposed applications. Additionally, hackers are known to leverage vulnerability scanners from vendors in the same way that organizations do to enhance their security posture.

The next step is to inject SQL commands through the web application which are then executed by a backend database. Because programmers often connect SQL commands with user-provided parameters, hackers have the ability to embed SQL commands inside these parameters. As a result, the attacker has the ability to execute SQL commands on the backend database server via the web application. While there are multiple approaches to carrying out this category of attack, the targets are particular database tables that contain valuable information.

No matter which methods or motivations are behind the exploitation of add-ons and CMS systems, hackers are after regulated or sensitive data. On one hand, using third-party add-ons leave the enterprise with full responsibility for securing the application, and on the other hand, very limited capacity to actually control the code. Because third-party add-on code cannot be fixed in-house, it is important that IT and Information Security teams have the appropriate technology in place to shield the application from attacks, given the potential vulnerabilities.

Protecting Your SharePoint SystemComplementing Traditional Defenses with Dedicated ProtectionIT and Security teams continue to spend the vast majority of their cyber security budget on traditional defenses, with the assumption that next-generation firewalls (NGFW) or intrusion prevention systems (IPS) will mitigate attacks against third-party plug-ins or Web Parts. While these defenses are an important and key part of security strategy, they are ill-equipped to stop attacks of this nature. Even if they were 100% effective, additional layers would be needed to ensure that critical business data is protected.

These solutions are designed to protect networks and users, and although next-generation firewalls are “application aware,” meaning that they can prevent users from visiting phishing sites or tunneling applications in HTTP, they are not designed to protect web applications from external attacks. Hackers looking to steal sensitive data, such as intellectual property, deal data or PII, know exactly where to find it: in SharePoint’s unique application, file, and database elements. The reality is that cyber-attacks have become increasingly sophisticated, leveraging new hacking methods, with the explicit purpose of circumventing conventional barriers.

Trend Report

Lessons Learned From the Yahoo! HackIn 2012, a hacker claimed

to have breached Yahoo!’s

security systems and acquired

full access to certain Yahoo!

databases, leading to full access

on the server for that domain.

Imperva found that the hacker

was able to determine the

allegedly vulnerable Yahoo!

application and the exact

attack method, SQL injection.

This attack underscores the

security problem posed by

hosting third-party code—

as is often done with cloud-

based services.Download Report

7

Technical RecommendationsAs an enterprise builds out its security model, it is common that vulnerable components outside the purview of the organization are not taken into account. It’s important that IT and security teams always assume that third-party code present in SharePoint applications contain significant vulnerabilities.

Protect SharePoint Instances Leveraging Third-party Code Against Web AttacksTo protect CMS systems, it’s vital that organizations incorporate security into the software development life cycle; perform penetration tests and vulnerability assessments on applications; and deploy SharePoint applications behind a web application firewall (WAF) in order to detect and block attacks. When third-party code is present, protecting applications with a web application firewall is essential. Without the ability to fix the code, a WAF is the only relevant protection option.

As Gartner states in “Security No-Brainer #9,” it’s fundamental that application vulnerability scanners interface with application firewalls. Analyst Neil McDonald states that once an application security testing tool identifies a vulnerability, the natural next step is to fix the problem. However, this presents challenges if the development team is backlogged, or IT teams don’t have access to the source code15.

Furthermore, PCI DSS requirement 6.6 provides two options for protecting web applications16. This first option is to conduct a vulnerability assessment and incorporate these assessments into the software development life cycle. The other option is to deploy a web application firewall in front of the web application.

Harden the SharePoint SystemWhen an add-on is promoted from development to production, the system configuration must be hardened to disable any irrelevant parts that may help the attacker. In the hardening process, detailed error messages should be disabled; excessive file and directory permissions should be restricted; leftover source code should be deleted; and so on.

Three-layers of SharePoint SecurityWhile this paper focuses on the security implications of third-party web applications, parts and plug-ins, the SharePoint system can be compromised on many levels. In addition to web-based attacks, both malicious insiders, as well as users that have been compromised by malware, pose significant risk. Moreover, Microsoft SharePoint does not have sufficient built-in security capabilities to protect your organization from the wide range of internal and external SharePoint threats. Imperva SecureSphere™ for SharePoint offers a unique three-layer approach for protecting all of SharePoint’s web, file, and database resources.

White Paper

What Next Generation Firewalls MissWeb application attacks threaten

nearly every organization with

an online presence. While some

security vendors contend that

their next generation firewalls

can stop Web attacks, these

products lack essential Web

security features, leaving

customers exposed to attack.Download White Paper

15. Neil MacDonald. “Security No-Brainer #9: Application Vulnerability Scanners Should Communicate with Application Firewalls.” Gartner, Inc.

16. “Information Supplement: Application Reviews and Web Application Firewalls Clarified.” PCI Security Standards Council.

8

Layer #1: Deploy a Web Application Firewall Tailored to SharePointTraditional technologies leave holes in application defenses—defenses that are only addressed by dedicated web application firewalls. SecureSphere for SharePoint uses market leading web application firewall technology to protect SharePoint web applications with vulnerable components. Through defenses such as patented Dynamic Profiling technology, SQL injection and XSS correlation engines, and detection of Microsoft SharePoint HTTP protocol violations, SecureSphere identifies zero-day attempts to exploit vulnerable components. In addition, once a new vulnerability is published, the Imperva Application Defense Center (ADC) quickly develops a signature or a set of policies to virtually patch the vulnerability. Through automatic security updates, all SecureSphere appliances receive the latest security content, and are protected against newly published vulnerabilities.

Many organizations do not know what third-party components are used in their web applications, nor do they track vulnerability announcements for these components. As a result, applications built with vulnerable components are often exposed to attack for long periods of time. The SecureSphere Web Application Firewall solution has multiple layers of defense to protect applications with third-party components.

Layer #2: Safeguard Files, Folders, and Lists with User Rights Management and Activity MonitoringSharePoint administrators often face challenges managing user permissions; maintaining a comprehensive audit trail of file access activity; and producing reports for compliance and forensic purposes.

SecureSphere for SharePoint offers a user rights management framework which aggregates and consolidates user rights across SharePoint sites, providing visibility into effective SharePoint permissions. This allows organizations to efficiently conduct rights reviews, eliminate excess rights, and identify dormant users--all of which help ensure that access is based on business need-to-know.

Additionally, Imperva’s SharePoint solution provides continuous monitoring and a detailed audit trail of all data access activity, showing the “Who, What, When, Where, and How” of each data access. This enables security, compliance, and SharePoint administrative staff to understand exactly who accessed, moved, changed, or deleted data. Furthermore, SecureSphere offers a flexible security policy framework, which allows businesses to respond immediately when data access activity deviates from corporate policy.

Natively, SharePoint offers rudimentary reporting capabilities that are insufficient for compliance reporting and investigating security incidents. SecureSphere for SharePoint features interactive, on-screen audit analytics to quickly visualize file data access activity and user rights. Security and compliance teams can use these analytics to identify trends, patterns, and problems with file activity, and user rights. SecureSphere’s analytics and reporting help measure risk and document compliance with regulations such as SOX, PCI, and data privacy laws.

eBook

SharePoint Security PlaybookThe increasing use of Microsoft

SharePoint to store sensitive

business data and extend

access and collaboration

to partners, customers, and

suppliers has outpaced native

SharePoint security capabilities.

By implementing the five lines

of defense outlined in this

eBook, organizations will be

able to overcome operational

challenges and protect

SharePoint deployments

against both internal and

external threats.Download eBook

9

Layer #3: Protect SharePoint’s Microsoft SQL Database from TamperingThe Microsoft SQL database is at the core of the SharePoint platform—storing all files, lists, and application data. Internal security requirements and compliance mandates call for privileged-user monitoring and preventing unauthorized database access. This also applies to the database component of the SharePoint platform. SecureSphere for SharePoint monitors all database access and ensures unauthorized access is prevented.

ConclusionMicrosoft SharePoint is one of the most widely deployed and used content management and collaboration platforms in the world. For the vast majority of organizations, that means that SharePoint holds and provides application-level access to business-critical data. As businesses seek a rapid return on their SharePoint investments, it’s common for them to turn to third-party SharePoint add-ons to expand the power and utility of SharePoint. From a security and compliance perspective, adding these extensions to an already complex business system means that additional, tailored measures need to be put in place to safeguard business data and applications. These include web application firewall technology, rights management capabilities, and activity monitoring for all data access. SecureSphere for SharePoint addresses all of these requirements in a single, integrated package.

www.imperva.com

© Copyright 2013, Imperva. All rights reserved. Imperva and SecureSphere are registered trademarks of Imperva. All other brand or product names are trademarks or registered trademarks of their respective holders. WP-VulSPAddOns-0913.1

Data Center Security SolutionsImperva, pioneering the third pillar of enterprise security, fills the gaps in traditional security by directly protecting the high-value applications and data assets in physical and virtual data centers. Over 2600 customers in more than 75 countries rely on our SecureSphere® platform to safeguard their business.

DATABASE SECURITY PRODUCTS

Database Activity MonitoringFull auditing and visibility into database data usage

Database FirewallActivity monitoring and real-time protection for critical databases

Discovery and Assessment ServerVulnerability assessment, configuration management, and data classification for databases

User Rights Management for DatabasesReview and manage user access rights to sensitive databases

ADC InsightsPre-packaged reports and rules for SAP, Oracle EBS, and PeopleSoft compliance and security

FILE SECURITY PRODUCTS

File Activity MonitoringFull auditing and visibility into file data usage

File FirewallActivity monitoring and protection for critical file data

SecureSphere for SharePointVisibility and analysis of SharePoint access rights and data usage, and protection against Web-based threats

Directory Services MonitoringAudit, alert, and report on changes made in Microsoft Active Directory

User Rights Management for FilesReview and manage user access rights to sensitive files

WEB APPLICATION SECURITY PRODUCTS

Web Application FirewallAccurate, automated protection against online threats

ThreatRadar Reputation ServicesLeverage reputation data to stop malicious users and automated attacks

ThreatRadar Fraud PreventionStop fraud malware and account takeover quickly and easily

Share this White Paper with Your Network