0

We are exploring the possibility of making our Intranet available to our employees outside of our network (and not over VPN). Besides firewalls/forward proxies and such (like the Threat Management Gateway), what other tools are out there to help secure the site and servers from unauthorized access / intrusion?

What do most organizations do for this?

1

3 Answers 3

2

Forefront UAG or TMG are good products for publishing SharePoint externally in a secure manner.

The extent you go to protect your environment depends on your security requirements, but at the least I would suggest placing your externally facing server(s) in an isolated subnet (DMZ). Some organisations go to the extent of creating an external user directory (e.g. an ASP.NET membership store or additional AD).

In past organisations I have also worked with external penetration testing firms to validate infrastructure and application security.

4

Make the site available over SSL. No point in havign the access to your site in order when anyone can just intercept all the data retrieved by users because the connection to the site they use is not secure.

If you don't want to use SSL to access the site from inside your network, you can use SSL offloading (using TMG or a hardware loadbalancer). This would require you to configure your web app's AAMs (Alternate Access Mappings, which even for me, after 6 years of SharePoint still feel a bit like "Here be dragons" :-D). To learn more about AAM, read the SP Team blog's 3 part blog article "What every SharePoint administrator needs to know about Alternate Access Mappings":

1
  • +1 for mentioning SSL. It almost goes without saying... but not quite! :-) Mar 31, 2012 at 23:58
2

I have known organizations implementing Microsoft Forefront Protection for SharePoint farms.

This gives many awesome security features just for SharePoint sites, like scanning of any files or attachments which are uploaded to the site, which may contain malicious code.

1
  • We do already have an Anti Virus solution, looking more for firewall/intrusion protection, denial of service attack protection, etc. Thanks. Dec 2, 2011 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.