* Making sure users only see what they're allowed to see
Out of sight, out of mind. It’s an aphorism, a truism, an old wives’ tale – but there is a ring of truth to it, a little bit of wisdom.
How often does a user ask you what’s in a file or folder that they can see, but can’t get to?
If you audit file and folder access, how often do seemingly honest and innocent people attempt to see what’s hidden behind names such as “payroll” or “expenses” or “problems”?
File system rights, privileges and attributes can protect the files and folders from those who shouldn’t be opening them. That’s easy enough to do – you assign those permissions every day to various individuals and groups. But it’s really just human nature to want to investigate everything we see, don’t you think?
Imagine that you’re out for a walk and see a five-foot wall. Imagine also that there’s a sign on the wall that says, “Do not look over this wall.” What would most people do? Right, they’d sashay up to the wall and peek over it. Now suppose that what they saw when peeking over the wall was a blankness, a nothingness, simply a void. Would they say “Ah, that’s it then” and wander off? Or would they try to find another way around the wall to see what’s really on the other side.
The same is true of files and folders in your file system. You can put up walls and signs, but the users can still see them and wonder about what’s on the other side.
It no longer has to be that way. Brian Styles and the good folks at ScriptLogic have developed (and are selling as of this week) Cloak – the access control utility that Microsoft forgot. Install Cloak on your system and users will only be able to see the files and folders that they have permission to view. Revoke their permissions and the folder disappears. Grant them again, and once again they can see the files.
Cloak is a server-based file system driver. It hooks into the Windows kernel just like your real-time anti-virus, open-file back-up agent, Windows compression and encryption drivers. As ScriptLogic’s “How Does it Work?” document (https://www.scriptlogic.com/eng/products/cloak/howitworks.asp) says: “When a user makes a request of the server’s file system, the request traverses the kernel stack and is analyzed by the Cloak driver before the results are returned to the user. The ACLs [Access Control Lists] of the objects, including files and folders, are cross-referenced to the user’s group membership. Objects that the user has no access to are filtered out before the results are returned.” It’s quick, it’s easy and it’s totally transparent to the user.
Just one more really useful tool from the helpful folks over at ScriptLogic. Try it out today.
