Dynamic Access Control: Scenario Overview
Applies To: Windows Server 2012
In Windows Server 2012, you can apply data governance across your file servers to control who can access information and to audit who has accessed information. Dynamic Access Control lets you:
Identify data by using automatic and manual classification of files. For example, you could tag data in file servers across the organization.
Control access to files by applying safety-net policies that use central access policies. For example, you could define who can access health information within the organization.
Audit access to files by using central audit policies for compliance reporting and forensic analysis. For example, you could identify who accessed highly sensitive information.
Apply Rights Management Services (RMS) protection by using automatic RMS encryption for sensitive Microsoft Office documents. For example, you could configure RMS to encrypt all documents that contain Health Insurance Portability and Accountability Act (HIPAA) information.
The Dynamic Access Control feature set is based on infrastructure investments that can be used further by partners and line-of-business applications, and the features can provide great value for organizations that use Active Directory. This infrastructure includes:
A new authorization and audit engine for Windows that can process conditional expressions and central policies.
Kerberos authentication support for user claims and device claims.
Improvements to the File Classification Infrastructure (FCI).
RMS extensibility support so partners can provide solutions that encrypt non-Microsoft files.
In this scenario
The following scenarios and guidance are included as part of this content set:
Dynamic Access Control Content Roadmap
Scenario |
Evaluate |
Plan |
Deploy |
Operate |
|---|---|---|---|---|
Scenario: Central Access Policy Creating Central access policies for files allow organizations to centrally deploy and manage authorization policies that include conditional expressions using user claims, device claims, and resource properties. These polices are based on compliance and business regulatory requirements. These policies are created and hosted in Active Directory, therefore making it easier to manage and deploy. Deploying Claims Across Forests In Windows Server 2012, the AD DS maintains a ‘claims dictionary’ in each forest and all claim types in use within the forest are defined at the Active Directory forest level. There are many scenarios where a principal may need to traverse a trust boundary. This scenario describes how a claim traverses a trust boundary. |
Plan for a Central Access Policy Deployment Best Practices for Using User Claims Using Device Claims and Device Security Groups Tools for Deployment |
|
||
Scenario: File Access Auditing Security auditing is one of the most powerful tools to help maintain the security of an enterprise. One of the key goals of security audits is regulatory compliance. For example, industry standards such as Sarbanes Oxley, HIPAA, and Payment Card Industry (PCI) require enterprises to follow a strict set of rules related to data security and privacy. Security audits help establish the presence or absence of such policies; thereby, they prove compliance or noncompliance with these standards. Additionally, security audits help detect anomalous behavior, identify and mitigate gaps in security policy, and deter irresponsible behavior by creating a record of user activity that can be used for forensic analysis. |
Deploy Security Auditing with Central Audit Policies (Demonstration Steps) |
|||
Scenario: Access-Denied Assistance Today, when users try to access a remote file on the file server, the only indication that they would get is that access is denied. This generates requests to helpdesk or IT administrators that need to figure out what the issue is and often the administrators have a hard time getting the appropriate context from users which makes it harder to resolve the issue. |
||||
Scenario: Classification-Based Encryption for Office Documents Protection of sensitive information is mainly about mitigating risk for the organization. Various compliance regulations, such as HIPAA or Payment Card Industry Data Security Standard (PCI-DSS), dictate encryption of information, and there are numerous business reasons to encrypt sensitive business information. However, encrypting information is expensive, and it might impair business productivity. Thus, organizations tend to have different approaches and priorities for encrypting their information. |
Scenario: Classification-Based Encryption for Office Documents |
|||
Scenario: Get Insight into Your Data by Using Classification Reliance on data and storage resources has continued to grow in importance for most organizations. IT administrators face the growing challenge of overseeing larger and more complex storage infrastructures while simultaneously being tasked with the responsibility to ensure total cost of ownership is maintained at reasonable levels. Managing storage resources is not just about the volume or availability of data anymore, but also about the enforcement of company policies and knowing how storage is consumed to enable efficient utilization and compliance to mitigate risk. File Classification Infrastructure provides insight into your data by automating classification processes so that you can manage your data more effectively. The following classification methods are available with File Classification Infrastructure: manual, programmatically, and automatic. This scenario focuses on the automatic file classification method. |
Scenario: Get Insight into Your Data by Using Classification |
|||
Scenario: Implement Retention of Information on File Servers A retention period is the amount of time that a document should be kept before it is expired. Depending on the organization, the retention period can be different. You can classify files in a folder as having a short, medium, or long-term retention period and then assign the timeframe for each period. You may want to keep a file indefinitely by putting it on legal hold. |
Scenario: Implement Retention of Information on File Servers |
Deploy Implementing Retention of Information on File Servers (Demonstration Steps) |
Note
Dynamic Access Control is not supported on ReFS (Resilient File System).
See also
Content type |
References |
|---|---|
Product evaluation |
|
Planning |
|
Deployment |
|
Operations |
|
Tools and settings |
|
Community resources |