I just discovered that we store sensitive information on our SharePoint. Since it’s accessible by a password alone (and we all know that others click for the password/user name to be automatically pre-filled, even at an outside computer), I feel that we’re not managing it securely enough.
The problem is that before I can make some waves regarding it, I need to suggest a better solution. This far, I suggested that we e-mail it to each other (since that requires at the very least login to Exchange, something that needs to be provided at each synchronization).
It’s faaar form perfect, of course.
I’ve googled for the issue and I get a lot of general hints and generic suggestions. I’d like to add to them the info on actual software that can be used or a pattern that’s practically declared.
We’re sitting on SharePoint, Windows 7/8, Exchange Server and use windows authentication via AD when accessing our computers.
Often, we’re working at the office (65%) or at home (25%) but some portion is done in a coffee shop or such (10%). The information to be stored is just a text file (or a set of text files) and needs not necessarily to be compartmentalized inside our organization (we trust all the employees). The information needs to be centrally available (as it can change on occasion) but there’s no need to encrypt it.
Thoughts?
Store it in Excel or similar, and encrypt the document so the user has to download and then enter a different password to view it. Not only does this get around your problem of stored browser passwords, it also reinforces the user’s attitude to the information as it requires some effort to access – ie. helping to remind them that it is sensitive and requires a little more care.
Of course, you now have a problem of having a sensitive excel document sitting on people’s laptops…
4