Dealing with file security breaches

[howler]

I can't get my head round a sensible way to deal with security breaches of ntfs folders, here is the scenario:

Auditing is turned on and checking for security failures on files or folders, event log captures these security failures. Lets assume for the moment that they are genuine attempts to access something the user shouldn't

How do you act on that information? Do you ask to the user why they tried to access folder x? Surely the response will be, it was an accident or they will just lie about the situation?

Now if it goes a step further and somehow they manage to access data they shouldn't. how will you ever know about it becuase you cannot spend all day looking at success audits?

To add to the problem I find that the auditing is pretty bad at being accurate, especially if the user has read only access to an office file a security failure often generates, I guess this is windows working out what it can and cannot do?

I'm sure other people on here must have to audit this sort of stuff, I need to come up with a way of auditing and identifying security breaches so they can be acted on but I keep going round in circles

 

[howler]

The issue is that if the user has got at the data and a breach has been identified it really is too late.

Prevention is better than cure and all that, obviously ACLs should take care of it and I can provide historic event logs where required

But, if we went down the route of something like GFI events manager how do you approach staff about these breaches? Do you just secretly build up the information for use at a later date?

Even with a tool like that surely you still aren't likely to know if a user has managed to get somewhere the 'shouldn't' have permission to?

 

[howler]

That makes sense and saves me a great deal of hassle

The next thing is that how does the manager define false positives from genuine malicious attempts?

I know from previous experience that the windows auditing generates a lot of false positives

 

[howler]

Ok that gives me something to work with, I think I will be very selective about the folders I audit so that the logs aren't full of spam!

Thanks for your comments Iain