SharePoint 2010 Custom List: Row Level Secuity

Business Case: Sharing a comprehensive list data among different stakeholders where every stakeholder can view\read only those row as per her Role\Unit


Resolution: 
(1) Export the existing list data into SharePoint custom list including the column: Unit.
(2) Add a new empty temporary column: trigger update.
(3) Build a row level security based on the field row for each row.

Let's elaborate on step number (3), where we are going to create a new workflow assocuated with this list and to run on every Create\Update item.


a) Create Permissions groups within SharePoint. 
Each Group will be equivalent to each Unit, same name.

b) Create the workflow:
1) Open the SharePoint site with Microsoft SharePoint Designer.
2) Navigation --> Site Objects --> Lists and Libraries --> Open that specific custom list with the data.
3) From the upper toolbar: list Workflow to create a list workflow.

4) Set Start options for the workflow: Item Created\Changed.

5) Edit Workflow.

6) Click Impersonation Step on the top toolbar to add a new Impersonation step, then remove the existing Step 1.

7) Click on the orange underline to activate the toolbar Action button.

8) Add a new action: Replace List Item Permissions.

9) Similarly, beneath it, add a new action: Add List Item Permissions.

10) Since we are interested to set the security on the item level, this workflow will do the function on the current item, replace this list in both steps with Current Item

11) To guarantee that the owners still have the permissions to access this list item, grant site owners all the permissions in the first replace step.

12) Now, to the core idea which is matching the field Unit with the equivalent group.
The result is that each row will have Read Access granted to the group members for the equivalent members of the group with the same name.

13) Save and Publish.

14) It is recommended to break the inheritance for this custom list so that the list items would be immune to any permissions changes at higher levels.

15) One time step: activate the workflow on all the items through through filling in the temporary column  created earlier: Trigger Update. A simple way to do it is through filling it within the Spreadsheet view for the list. Delete the temporary column:Trigger Update from the list.

Tip: Control sharing your personal data within linkedin with third parties

Understanding Microsoft SQL Server permissions

Below is a very good article about the permissions check order. Also explains chaining; when an object accesses another object.

http://technet.microsoft.com/en-us/library/dd283095(v=sql.100).aspx
Although the article was for SQL Server 2008, most concepts are still valid for 2012 version.

Security Tip: SharePoint 2010 Access to all users (Authenticated users)

Site Actions -->
Site Permissions -->
Grant Permissions -->
Select Users --> NT AUTHORITY\authenticated users


What happened to Add All Authenticated Users?

Anti-Secuity Tip: Really simple iOS Passcode

1) Enable (Simple Passcode) option, so that your code can constitute 4 numeric digits only.

2) Simplest Passcode to enter is: 2 5 8 0. Four digits is a vertical line.

Tip:
- This post is not a security post as the name implies.
- This post is useful in similar cases when you register Exchange account with a policy to have a passcode; however, you are sure that your device is secure and you do want to have the least interruption with the passcode screen.

IT Department Priorities for 2014

If asked for my own personal view for the priorities for a typical IT department for medium to large organization to focus on for 2014 [it is now Q3\2013], without regard to any specific area or industry;

[Revised, Q3/2014]

I would answer:

1) Measuring and monitoring IT performance.
[This should cover both staffing and activities. Moreover, this should have already been established; however, but the metrics for measuring have to be updated on annual basis due to the changes in the priorities themselves.]

2) Business Intelligence.
[Its value is very clear as the tools have evolved so much over the last 10 years, and making best use of these tools is a quick win.]

3) H\W Virtualization.
[To make sure that no H\W servers still exist, and when done, the reporting and logging needs to be optimized to minimize the overhead and to maximize the insight into the machines operations.]

4) Agile development.
[No more time or resources to waste on a classical S\W development model within an IT department.]

5) Cloud computing.
[Seeking a hybrid approach, private and public]

6) Security Management and privacy.
[It is always among my priorities, the only weapon here is that knowledge within this area has to be always up-to-date]

7) Information Assets Management.
[$ missed here are usually more than one can imagine, especially with the ubiquitous of small and handheld devices. These assets must be probably managed and maintained]

8) Project Management Office.
[Strengthening the project management capacity can greatly improve all of the rest but with different ratios.]

9) Business Continuity and Disaster Recovery.
[The value of the investments here is only considered a value in the worst situations!]

10) Training.
[Being at the end of the list of priorities should not be read as not that important, but rather should be read as one of the priorities. It is only at the very bottom, since it is a recommended common practice to do first things first.]





References for opinions on that same topic for 2013:
http://www.protiviti.com/en-US/Documents/Surveys/2013-IT-Priorities-Survey-Protiviti.pdf
http://www.computerweekly.com/guides/IT-priorities-survey-2013

N.B.
I might update my list based on feedback.

Validating users using password, hash and salt

DB Fields:
Table User: Columns (UserName, Password, Salt)


Public Shared Function GetPasswordHash(Password As String, Salt As String) As String
Dim StringEncoder As New UTF8Encoding()
Dim Bytes_Password As Byte() = StringEncoder.GetBytes(Password)
Dim Bytes_Salt As Byte() = StringEncoder.GetBytes(Salt)

' Array for password & salt
Dim Bytes_Password_Salt As Byte() = New Byte(Bytes_Password.Length + Bytes_Salt.Length - 1) {}

For i As Integer = 0 To Bytes_Password.Length - 1
    Bytes_Password_Salt(i) = Bytes_Password(i)
Next

For i As Integer = 0 To Bytes_Salt.Length - 1
      Bytes_Password_Salt(i + Bytes_Password.Length) = Bytes_Salt(i)
Next

Dim MD5Provider As New MD5CryptoServiceProvider
Dim Bytes_Hash As Byte() = MD5Provider.ComputeHash(Bytes_Password_Salt)
Dim String_Hash As String = Convert.ToBase64String(Bytes_Hash)

Return String_Hash
End Function

Public Shared Function ValidateUser(UserName As String, Password As String) As Boolean
Dim IsValidUser As Boolean = False

Dim Cmd As New SqlCommand()
Cmd.CommandText = "SELECT [Password] PassHash, Salt AS Salt FROM [User] WHERE UPPER(UserName) = UPPER(@UserName) "
Cmd.CommandType = Data.CommandType.Text

Cmd.Parameters.AddWithValue("UserName", UserName)

Dim ds As DataSet = DBHelper.RunSQLQuery(Cmd)

Dim StoredHash As String = Nothing
Dim StoredSalt As String = Nothing
If ds.Tables.Count = 1 Then
    If ds.Tables(0).Rows.Count = 1 Then

       Dim CurrentRow As DataRow = ds.Tables(0).Rows(0)
       If Not IsDBNull(CurrentRow("PassHash")) Then
               StoredHash = CurrentRow("PassHash")
        End If

       If Not IsDBNull(CurrentRow("Salt")) Then
                StoredSalt = CurrentRow("Salt")
       End If
   End If
End If

If Not IsNothing(StoredHash) And Not IsNothing(StoredSalt) Then
   Dim CalculatedHash As String = GetPasswordHash(Password, StoredSalt)
   If CalculatedHash = StoredHash Then
        IsValidUser = True
   End If
End If

Return IsValidUser
End Function


Public Shared Function RunSQLQuery(ByVal Cmd As SqlCommand) As System.Data.DataSet
Dim s As New System.Data.DataSet()

Cmd.Connection = New SqlConnection(ConnectionString)
Dim a As New System.Data.SqlClient.SqlDataAdapter(Cmd)
a.Fill(s)

Return s
End Function