Data Access Management

PRO This feature is only available in Enterprise Recon PRO Edition. To find out more about upgrading your ER2 license, please contact Ground Labs Licensing. See Subscription License for more information.

This section covers the following:

• Overview
• Requirements
• Enable Data Access Management
• Disable Data Access Management
• View Access Status
  • View Access Permissions Details
• Manage and Control Data Access
  • Manage File Owner
  • Manage Permissions for Groups, Users, and User Classes
  • Access Control Actions

Overview

Controlling access to sensitive and PII data is a key concept in many data protection regulations. After taking the first step of data discovery, identifying who has access to the data is necessary to understand the risk of exposure. For example, does everyone with permissions to view a file still require that access? Which files have open permissions (e.g. accessible by everyone in your organization)?

With the Data Access Management feature, users can easily:

• View and analyze the access permissions and ownership information for sensitive data locations, and
• Immediately take action to minimize risk by managing and controlling access to those locations from the Investigate page.

The Data Access Management feature is disabled by default for:

• New installations of ER2 with the Enterprise Recon PRO license, and
• Existing installations of ER2 when upgrading from Enterprise Recon PCI or Enterprise Recon PII to an Enterprise Recon PRO license.

See Requirements and Enable Data Access Management for more information.

Requirements

Enable Data Access Management

When the Data Access Management feature is enabled, ER2 retrieves access permissions and ownership information in scans for supported Target locations. Users can then navigate to the Investigate page to analyze these access details and take the appropriate access control action to secure access to these locations.

Users with Global Admin and System Manager permissions can enable the Data Access Management feature in the Settings > Remediation > PRO Settings page.

To enable Data Access Management:

1. Log in to the ER2 Web Console.
2. On the Settings > Remediation > PRO Settings page, go to the Data Access Management section.
3. Set the toggle button to On.

Disable Data Access Management

Users with Global Admin and System Manager permissions can disable the Data Access Management feature in the Settings > Remediation > PRO Settings page.

Disabling the Data Access Management feature will result in the following:

• Access permissions information of all current match locations will not be viewable.
• Access permissions information will not be retrieved for match locations if the feature is disabled prior to the start of the scan.
• Access Control Actions will be unavailable.

To disable Data Access Management:

1. Log in to the ER2 Web Console.
2. On the Settings > Remediation > PRO Settings page, go to the Data Access Management section.
3. Set the toggle button to Off.

View Access Status

In the Investigate results grid, the Access column displays the number of unique users that have any level of access permissions to the match location. If a group(s) has access permissions for the given location, unique group members will be calculated as part of the total Access count.

There are two scenarios where "Everyone" instead of the unique user count will be displayed in the Access column.

• Windows - This applies if the built-in group Everyone has access permissions to the match location.
• Unix and macOS - This applies for match locations that have a non-zero value for the Others permission set.

If ownership or access permissions for a match location has been modified using ER2, a notification icon will be displayed in the Owner or Access column accordingly. The status of the last access control action performed for a match location will be reflected in the Access Control column.

Example

"File-B.zip" is a match location that the following groups and users have permissions to:

File-B.zip +-- Group-1 +-- Administrator +-- User-1 +-- Group-3 +-- User-3 +-- User-4 +-- Group-2 +-- Administrator +-- User-1 +-- User-2 +-- User-1

The Access column will indicate "3" for "File-B.zip" as there are three unique users who have access to the match location:

• Administrator
• User-1
• User-2

"User-3" and "User-4" are not included in the total Access count as they belong to "Group-3", which is a nested group and child member of "Group-1".

View Access Permissions Details

To view the list of groups, users, or user classes that have any level of access permissions for a match location:

1. Log in to the ER2 Web Console.
2. Go to the Investigate page.
3. Click on the match location to bring up the Access panel.

4. The Access panel displays information about the owner, groups, users or user classes (e.g. Owner, Group, Others) that have access to the match location, and the permissions associated with each group, user, or user class.

   If a group or user with access permissions to a location is deleted from the Target system, the Access panel displays the ID instead of the group or user name.

Manage and Control Data Access

There are several types of access control actions that can be taken on a match location, such as modifying file ownership properties, revoking access permissions for specific users or groups, and granting access to new users, groups, or user classes.

Manage File Owner

To modify the file owner property for a match location:

1. Go to the Investigate page.
2. Select the match location(s) that you want to manage access permissions for.
3. Click the Control Access button to bring up the Reassign Permissions dialog box.
4. Click on Change next to the File Owner label to change the file ownership for the location.
5. Select a new file owner from the list of domain or local user accounts. Alternatively, enter a new user account in the input text field and click Add.
   • New domain account: <domain>\<username>
   • New local account: <username>
6. Enter a name in the Please sign-off to confirm reassign field.
7. Enter a reason in the Reason field.
8. Click Reassign.
9. (Optional) To reset all changes made to file permissions, click Cancel to cancel the operation.

Manage Permissions for Groups, Users, and User Classes

To manage the access permissions for a match location:

1. Go to the Investigate page.
2. Select the match location(s) that you want to manage access permissions for.
3. Click the Control Access button to bring up the Reassign Permissions dialog box.
4. In the Reassign Permissions dialog box, you can
   • Remove specific groups, users, or user classes
   • Modify the permissions for existing groups, users, or user classes
   • Grant permissions to new groups, users, or user classes
   • Keep or revoke permissions for existing groups, users, or user classes
5. Enter a name in the Please sign-off to confirm reassign field.
6. Enter a reason in the Reason field.
7. Click Reassign.
8. (Optional) To reset all changes made to file permissions, click Cancel to cancel the operation.

Access Control Actions