Contractor Access and Departmental NAS Isolation
A PowerStore 1200T is shared by Finance and Engineering. Both departments use the same NAS server because it was quicker to deploy. The Finance SMB share is configured with an ACL that allows the domain group 'Domain Users' modify access. A contractor is hired for two weeks to monitor performance. The storage admin creates a local PowerStore user named 'contractor' and assigns the Administrator role because 'Read Only did not show the performance dashboard.' Finance reports that an Engineering user opened a Finance spreadsheet, and the contractor's account was able to delete a test snapshot. The array also hosts block volumes for Engineering; no data loss has occurred, but the security team wants a correction plan. The contractor only needs to view performance and alerts.
1. What is wrong with the contractor's access, and what role should be used?
Read the worked answer
Administrator is far too broad. It can change or delete storage objects, not just view performance. The contractor should have a read-only monitoring role, and the account should be time-limited and reviewed. If the built-in Read Only role truly did not show the required performance view, fix the dashboard or permission design rather than granting Administrator. Verify the role assignment in PowerStore, remove Administrator immediately, and review audit logs for actions taken by the contractor. Use a separate account per person, not a shared local account, and disable it at the end of the engagement.
2. How would you isolate Finance file access without disrupting Engineering?
Read the worked answer
Create a separate NAS server for Finance with its own IP address and, where possible, a dedicated VLAN. Move the Finance SMB share to that NAS server. Set share permissions to the Finance security group only and remove Domain Users; then verify NTFS permissions on the underlying folder. Separate NAS servers provide an administrative and network boundary; a folder ACL alone does not isolate departments if they share the same NAS server. Test with a Finance account, an Engineering account, and an administrator before cutover. Keep Engineering's block volumes unchanged.
3. What else should be reviewed for least privilege and multitenancy?
Read the worked answer
Review all local users and role assignments, especially any accounts with Administrator or Security Administrator. Check SMB share permissions and NTFS permissions separately, confirm that snapshot deletion is restricted, and enable or collect audit logs for file and administrative access. For multitenancy, document which NAS server, VLAN, and share belong to each department, and avoid sharing a NAS server between departments with different access requirements. Also review SupportAssist and remote access accounts, and set a recertification date for contractor access.