ACS Blogs

A blog site for Architecting Connected Systems staff to tell the world about their exploits in
SharePoint 2007/2010/2013, Windows Workflow Foundation (3.0/4.0) and other great technologies!
Welcome to ACS Blogs Sign in | Join | Help
in Search

Browse by Tags

All Tags » Security   (RSS)
  • O365 is not secure

    I used to think it was.  After all the amazing things you read on the O365 Trust Center, you all but think it is Fort Knox (well, at least one part of it is right Bill Baer?)  Let me go back to that title. "O365 is not secure...once you start adding users".  Last week I blogged about a security oversight in O365's ...
    Posted to CJG (Weblog) by cjg on June 4, 2014
  • Azure Access Control Services (ACS) is dead

    I recently went through the exciting process of setting up our site to support various authentication mechanisms (LiveID, Google, Federated Auth, etc).  I started off using Azure Access Control Services (ACS) because I thought it had everything I could ever want in a login aggregation platform.  However, I soon realized that ...
    Posted to CJG (Weblog) by cjg on May 30, 2014
  • SharePoint 2010 has explicit deny!

    What?  Are you serious?  The DenyPermsMask column is used now???  Oh yeah my friends, it can be used now!  Unfortunately, it can't be used at the site/web level.  It is in the web application policy level where you can now specify the explicit deny on permissions.  We have been waiting for this since SP1 of ...
    Posted to CJG (Weblog) by cjg on April 29, 2010
  • SharePoint 2010 Password Change Policy

    SharePoint 2010 has a great new feature for setting your service account passwords for when your AD team has locked down the password policies.  In Central Administration you can click Security->Manage service accounts links, and after selecting the account, you can then set the passwords for these accounts from central ...
    Posted to CJG (Weblog) by cjg on March 29, 2010
  • SharePoint Site/List/Item Effective Permission Finder!

    This is amazing, I was simply trying to figure out what the SharePoint Designer (Site->Contributor Settings) would do to permissions in the database.  So, I built this entire application to do it, but then realized after I got it built that SPDesigner simply creates a file in the _contributor_settings directory in the content database and ...
    Posted to CJG (Weblog) by cjg on May 25, 2009
  • Console program that dumps the contents of the Content Database (no SP Object Model)

    I have been a big proponent of encrypting the content database for a long long time.  You can see that is proved via the event handlers and custom actions via SharePoint Designer labs that I have built in my 50064 course.  When you do encryption though, you gain security at the loss of functionality (Search, browsing, all kinds of ...
    Posted to CJG (Weblog) by cjg on May 19, 2009
  • Most Commonly Missed Best Practice with Internet Sites

    Wanna know what it is?  It is a disaster waiting to happen!   Some day an IIS 6.0 vulnerability will come out that allows you to get administrator access to the _vti_bin directory of your SharePoint site.  You will then be able to execute a call to the Lists web service and delete the "Pages" document library! ...
    Posted to CJG (Weblog) by cjg on February 11, 2009
Powered by Community Server, by Telligent Systems