NetApp Filer auditing is indispensable to data protection, enforcement of internal controls and adherence to external regulations, for those organizations that use NetApp Filer appliances. NetApp monitoring and auditing changes in files, folders, and permissions help tighten security and ensure compliance. Learn how to best go about NetApp Filer auditing, what features are required and how the whole process can be approached.

1. File Auditing
with NetApp Filer
Chris Rich
NetWrix Corporation
Corporate Headquarters: 12 N State Rt 17, Suite 104, Paramus, NJ 07652
www.netwrix.com Office: (201) 490-8840, Toll-Free: (888) 638-9749, E-mail: sales@netwrix.com
facebook.com/NetWrix twitter.com/NetWrix youtube.com/NetWrix
netwrix.com/LinkedIn spiceworks.com/NetWrix netwrix.com/GooglePlus

2. White Paper:
File Auditing with NetApp Filer
Table of Contents
3 Why is File Auditing on NetApp Filer Important?
3 ....... File Auditing to Reduce Risk
3 ....... File Auditing to Improve Security
4 ....... File Auditing to Sustain Compliance
4 Required NetApp Filer Auditing Features
4 ....... Automatic Data Collection
5 ....... Efficient and Centralized Data Storage
5 ....... Scalability
5 ....... Advanced Reporting Capabilities
6 ....... File Integrity Monitoring
6 ....... Additional Considerations
7 NetWrix approach to File Auditing on NetApp Filer
8 About NetWrix
8 About the Author
8 Additional Resources

3. White Paper: 3
File Auditing with NetApp Filer
Why is File Auditing Important?
The importance of comprehensive file auditing is best illustrated by a real-world example. Data
housed in an organization’s servers and storage devices contain massive amounts of
sensitive information. It is absolutely critical that at any point in time, you can show an audit
trail of who has accessed files and folders or modified permissions of files and folders including
the date and time when the attempt or change was made and where the change occurred.
For organizations bound by regulations such as SOX, HIPAA, and PCI, detailed file auditing
showing who changed what, when, and where is a necessity. Without it, the organization risks
non-compliance which may result in fines and sanctions. Consider all the information in any
organization stored in various files: employee data, financial information, proprietary and trade
information not meant for public or even selective internal access.
File access violations have great potential of becoming much worse if information in sensitive
files has been modified or removed or if the file were deleted altogether. Without effective file
auditing in place, you have no way of providing an audit trail of who accessed what, when, and
where this activity took place. With file access auditing, this information could have been quickly
and easily discovered.
File Auditing to Reduce Risk
Detailed file access auditing delivers accountability and proof of regulatory compliance.
Automatic collection and reporting of file change and file access information provides
organizations with a steady stream of feedback regarding file activity in the enterprise. Using this
information can greatly reduce risks. A file permission change may allow a user or group to see
or modify sensitive information. A user repeatedly reviewing information they would not
normally read may reveal an employee who is providing a competitor with upcoming product
details. Important files deleted from a network share may explain why important reports were
not submitted on time. File auditing is the vehicle by which access attempts and changes made
to files, folders and permissions can be monitored to uncover security risks so they can be
addressed. On NetApp Filer, auditing permissions helps to ensure rights to sensitive data are
maintained properly. Effectively managing every aspect of user and administrator interaction
with the multitude of files within the environment reduces risk while granting the appropriate
access users need to perform their duties.
File Auditing to Improve Security
Employees are given a level of trust and when that trust is abused, organizations quickly become
victims. File auditing provides organizations with the ability to establish an audit trail for all file
system activity thus greatly improving security. Security flaws and holes are often discovered
after the fact and the reason for this is automatic file auditing and file audit reporting is not
present. Monitoring file activity frequently to improve security in the enterprise for both internal
and external threats. To improve file security, extract change information automatically and
review changes and access attempts on a regular basis.

4. White Paper: 4
File Auditing with NetApp Filer
File Auditing to Sustain Compliance
Regulations such as SOX, PCI, FISMA, and HIPAA each have their own security standard practices
including what exactly needs to be tracked and recorded in file systems. These regulations exist
to establish (IT) change auditing standards to protect both businesses and consumers. At the
end of the day, these regulations and their enforcement strive to confirm the organization is
securing, recording and monitoring change events that permit access to sensitive information
such as banking information, social security numbers, and health records. File and folder
permissions are essential to segregating information so that only select groups and individuals
can access it. Mostly, demonstrating compliance is an exercise in presenting this information to
auditors upon request and to the level of detail required. Auditing files, folders and permission
access attempts and changes provides the Who, What, When, and Where information most
frequently requested by auditors and almost equally important is the need to store this
information for sometimes up to 7 years or more to be considered compliant. For NetApp Filer,
this is extremely difficult and an entirely manual process with native functionality and therefore
will require specialized tools.
Required NetApp Filer Auditing Features
Centralized storage and reporting tools are unavailable for audit data on NetApp Filer natively
making the collection and reporting steps of change auditing for file, folder and permission
access attempts and changes difficult and time consuming without additional tools. There is also
a risk of losing audit data if event log settings are not set properly or the volume of information
logged and exceeding log limitations if too much information is being captured or purged prior
to review. Once native information is analyzed by an administrator experienced with the NetApp
Filer events and messages, the interpretation then would need to result in a decision to act.
Combine these factors and the result is native file auditing is not feasible except for smaller
environments that are adequately staffed to handle this workload.
Automatic Data Collection
In order to efficiently audit NetApp Filer, the process must be automated. Without automation,
collecting the information in a timely manner is not feasible. This is especially true as the size of
the organization will have a great impact on the raw volume of information collected making it
even more challenging to track and report NetApp Filer changes. Additional scripting and/or a
3rd-party file server monitoring tool are frequently employed to collect event data. Furthermore,
if audit data is not collected regularly, there is a risk of losing this information due to log
overwrites or retention settings unsuitable to the overall requirements. This is an important
required feature to change auditing because without it, timely auditing is nearly impossible.

5. White Paper: 5
File Auditing with NetApp Filer
Efficient and Centralized Data Storage
Automation of any kind typically requires additional resources and may negatively impact
system performance. For this reason, it’s important that the impact of the method employed to
automatically collect data is minimal. Furthermore, storage of data must also be a consideration
during implementation. While it is possible to store audit data exclusively on the NetApp Filer
where the events are taking place, the preferred method will be to centralize this information in
a data store that is both secure and readily available. This greatly facilitates analysis and
reporting making it easier to integrate NetApp Filer auditing into your daily routine.
Collection of information must also be reliable. Occasionally, each piece of the file auditing
system should have a periodic check to ensure information is consistent when collected. The
most advanced methods of reliably collecting this information will also have the ability to
pre-screen data and filter for only essential information. During collection, preference should be
given to methods that leverage the native audit information that will eliminate common noise
and log excess that is not of value. To completely understand an event, information from all
sources involved must be aggregated and analyzed as a whole. Securing this information for
short and long-term storage is also an important consideration and thus best-practices for
securing audit data should be included pre-deployment such that no single power-user has
access to or the ability to delete or tamper with the audit trail. Access to this information should
be heavily restricted and monitored as well.
Scalability
To audit file changes, access attempts and permission adjustments in the enterprise, the
solution must be readily scalable to adjust to a constantly changing environment without the
need for dramatic steps. Implementation and ongoing NetApp Filer auditing will be simplified
when no additional software or extensive reconfigurations are required when adjusting to
changes within the organization. Auditing needs to keep pace with all granular changes as the
overall topology of the network changes.
Advanced Reporting Capabilities
Once data has been stored securely, file auditing can assume a proactive role in sustaining
compliance, securing information and improving overall stability. Moving forward automatic
reporting provides customizable summarized report output on every change and access
attempt for any time period. Reporting needs to present report data in a clearly understandable
format that is easy to understand including all the important details such as Who made What
change, When and Where as well as Before and After Values. Without the ability to produce clear
information on change history for day-to-day modifications to files and folders, such as, who
changed shared folder permissions or who deleted an important accounting spreadsheet,
sustaining compliance, stability and security will be difficult if not impossible and many
opportunities to implement NetApp Filer auditing will be surrendered.

6. White Paper: 6
File Auditing with NetApp Filer
Using SQL to store data and leverage SQL Reporting Services are obvious choices for storing and
reporting on data in most environments. SQL Server Express Edition with SQL Reporting Services
can be downloaded for free from Microsoft and expertise with SQL is common and frequently
available. Having the ability to customize ad-hoc and predefined 3rd-party reports will accelerate
file auditing efforts by saving time and providing configuration options to suit the majority of
needs. Using reports on a daily basis ensures complete visibility over the entire NetApp Filer
infrastructure providing opportunities to improve security and sustain compliance. Additional
reporting services such as e-mail alerts and subscription capabilities and will also add to the
impact advanced reporting will have on overall file systems management effectiveness. Once
established, reporting will be the main driver behind successful sustained NetApp Filer auditing
day-to-day.
File Integrity Monitoring
File Integrity Monitoring, or FIM, ensures the integrity of files by monitoring a hash
representation of a file instead of the entire file itself. This approach allows for fast detection of
file changes facilitating timely alerting when a change occurs on a file. FIM is also required for PCI
compliance. Using file integrity monitoring in your NetApp Filer auditing is necessary to provide
the highest level of security and meet PCI compliance.
Additional Considerations
Preferred solutions (and providers) should offer additional capabilities to form a comprehensive
management suite to maximize the potential benefits of change auditing throughout the
environment. This includes auditing of file and other changes in Windows servers and other
appliances such as EMC Celerra. Additional auditing capabilities may include network devices
such as firewalls and Microsoft technologies such as Active Directory, Group Policy, Exchange,
SQL and SharePoint. Real-time alerting and object restore features will also add value to any
enterprise-wide change auditing solution.

7. White Paper: 7
File Auditing with NetApp Filer
NetWrix Approach to NetApp Filer Auditing
NetWrix NetApp Filer Change Reporter is a specialized NetApp Filer auditing solution that
monitors changes made to files, folders, permissions and successful access events across the
entire enterprise using AuditAssurance™ technology. This technology ensures accurate details
of audit events by pulling from multiple resources and compiling into single human-readable
records for each change. This product is part of NetWrix File Server Change Reporter which
audits these same events on Windows file servers and DFS shares as well as other appliances
such as EMC Celerra. It generates NetApp audit reports that include the four W’s: Who, What,
When, and Where for every audited file change, permission change, or successful access
attempt, including before and after information.
Using the AuditIntelligence™ technology, NetWrix is able to present complex native logging
conventions and formats into simple and easy to understand reports. NetWrix also provides up
to three custom-built reports at no additional cost. The automatic collection and reporting on
NetApp audits not only surpasses any native capabilities in NetApp, Windows and EMC Celerra
but expands upon them eliminating the time and effort spent collecting change audit
information manually or through any other means making this information highly reliable, easily
understandable and actionable. It has the ability to sustain compliance through historical
reporting for up to 7 years and more. File integrity monitoring further extends the oversight on
files through advanced change detection methods.
In addition to file auditing for Windows, NetApp and EMC, NetWrix offers additional integrated
modules for Active Directory, Group Policy and more helping protect existing investments in
current NetWrix product installations by offering current license credit applicable to additional
licenses of other NetWrix software solutions.
See how the NetWrix NetApp Filer Change Reporter included in the NetWrix File Server Change
Reporter can help with your auditing and compliance needs.
Download link: netwrix.com/netapp_download

8. White Paper: 8
File Auditing with NetApp Filer
About NetWrix
NetWrix Corporation is a highly specialized provider of solutions for IT infrastructure change
auditing. Change auditing is the core competency of NetWrix and no other vendor focuses on
this more extensively. With the broadest platform coverage available in the industry, innovative
technology and strategic roadmap aiming to support different types of IT systems, devices and
applications, NetWrix offers award-winning change auditing solutions at very competitive prices,
matched with great customer service. Founded in 2006, NetWrix has evolved as #1 for Change
Auditing and Compliance as evidenced by thousands of satisfied customers worldwide. The
company is headquartered in Paramus, NJ, and has regional offices in Los Angeles, Boston
Tampa, Miami, UK and Japan.
About the Author
Chris Rich has been involved in numerous aspects of IT for over 16 years including help desk,
systems administration, network management, network architecture, telecom and software
sales and sales engineering, and product management. He is also a certified technical trainer,
MCSA, avid runner, musician and happily married father of two.
Additional Resources
Information security professionals and trends - www.infosecisland.com
10 Immutable Laws of Security - http://technet.microsoft.com/en-us/library/cc722487.aspx
NetWrix Corporate Blog - http://blog.netwrix.com
NetApp Support Forum - https://communities.netapp.com/welcome
Corporate Headquarters: 12 N State Rt 17, Suite 104, Paramus, NJ 07652
www.netwrix.com Office: (201) 490-8840, Toll-Free: (888) 638-9749, E-mail: sales@netwrix.com
facebook.com/NetWrix twitter.com/NetWrix youtube.com/NetWrix
netwrix.com/LinkedIn spiceworks.com/NetWrix netwrix.com/GooglePlus
©2012 All rights reserved. NetWrix is trademark of NetWrix Corporation and/or one or more of its subsidiaries and may be
registered in the U.S. Patent and Trademark Office and in other countries.
All other trademarks and registered trademarks are the property of their respective owners.