I want to host confidential data on Sharepoint 2013 and would like to encrypt these data on a file level.

There is already a Transparent Data Encryption (TDE) feature available for Sharepoint but it is encryption at the database level.

If an attacker (somehow) bypasses the permissions set on the SharePoint library, then ideally this file should appear encrypted and not made available to the attacker.

Decrypting the file could require the correct Windows identity or a admin-defined password.

The million dollar question is: how can this be achieved? Can I write a custom web part and attach it to the library and encrypt all files that are uploaded with a password?


Option 1:

You can try IRM: IRM protection is applied to files at the list or library level. When you enable IRM for a list or library, you can protect any file type in that list or library for which a protector is installed on all front-end Web servers. A protector is a program that controls the encryption and decryption of rights-managed files of a specific file format. https://technet.microsoft.com/en-us/library/hh545607(v=office.14).aspx https://msdn.microsoft.com/en-us/library/office/ms458245(v=office.14).aspx

Option 2:

  • Write event handler When uploading any file in SharePoint encrypt the files with custom Password.
  • Write another event handler which decrypt the file when downloaded from SP with custom password.
  • This way even DB is hacked file can not be viewed without decryption.
  • 1
    You can't have an event receiver to intercep file downloads... – Evariste Feb 16 '16 at 9:42

+1 on the fact that event receivers won't help on download. Rights Management won't work in this case since IRM only applies when an authorized user is downloading the file. If an attacker circumvents that step they he will access the file without its IRM wrapper. You could pre-encrypt the file with something like Gnu Privacy Guard before uploading it to SharePoint but that will require software on all the end users' workstations and also requiring the users to make security decisions (fail). My company provides a solution that does this and I can tell you it was not easy to build a transparent encryption capability for SharePoint that addresses this threat AND doesn't break SharePoint functionality. My point being, if you want to build your own it will take a lot of time and effort but it's possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.