Confidentiality tagging - best approach

Question

We currently run a very large Sharepoint 2010 collaboration platform for our company (50,000 employees +), and we've come to the point where we need to help support our security team in letting employees "tag" their documents.

We have a few default security classifications we use internally - like "top secret", "open", "confidential", etc. Any one document must be given one and only one classification; I.e a document can't be both open and confidential. Every document must have a confidentiality level too- by default, it's just "confidential".

We want to roll out a solution whereby every file that is uploaded by an end user to our farm - no matter which site, library or document set it sits in, is given a security classification field, which defaults to "confidential". The user should have the option of choosing a new confidentiality, by editing the properties of the file - just like if they were to edit the name or owner, etc.

We're a little stuck as to the best approach to do this. It's been suggested we could use information management policies, workflows, or even creating a new document type that everything gets assigned to. However, we can't find any guidance anywhere as to the best practice, recommended way to do this.

Does anyone have any good suggestions for how to approach this? Ideally we want to stay as close as possible to the default / recommended behaviour in Sharepoint 2010 as possible! Any views or thoughts would be greatly appreciated :)

Answer 1

This isn't complicated but it isn't a straight forward OOTB but it is secure.

The method you would use is to make an event handler that creates and manages folders with specific permissions, the hierarchy of the folders is the structure of the content.

Each folder has different permissions, requiring group/user permissions for access. This gives windows the permission control which is far more secure than workflows etc for permissions.

The actual folder structure that you create would be up to you, and you control this depending on the selected of a simple drop down list on the form, having the default as your confidential setting.

It will be complicated to design this for 50,000 users as a structure, but once you have worked it out it will be easy. IF the permissions are based at group level, then you will have easier time, but the user will have to select which group(s) to share it with unless you can work out some logic.

For the structure I would make 36 (26 is fine if it is alpha only) base directories a-z and 0-9 for splitting up the users and in each another 36 to split up the usernames further and divide the usernames up by first letter, second letter in the folder tree. (This is a popular technique on web servers for storing multiple websites efficiently in a small a folder structure as possible)

Examples:

a/b/abbot/confidential (read/write for abbot only)

a/b/abbot/public (read for public and read/write for abbot)

s/t/stuart/confidential

s/t/stuart/public

Good luck.