Securing Analysis Services Data
Although the Setup program limits access to the Backup, Data, and Log folders to members of the Administrators local group and the Analysis Services logon account, you must make sure this data stays secure and is not compromised.
-
Access to the Backup folder is restricted, but there is no requirement that you use this folder when you back up an Analysis Services database. If you use a different folder for database backups, you should similarly secure that folder structure.
-
Not only is access to the Data folder restricted, but the files in the Data folder are stored in a binary format. This means that these files cannot be read by using a text editor. However, another instance of Analysis Services can read these files if the instance has access to the files in this folder. To limit this security risk, you must make sure that members of the Administrators local group and users who know the Analysis Services logon account password can be trusted.
-
If you move the Data folder after installation to another location, such as on a RAID array or a SAN, you must make sure that only members of the Administrators local group and the Analysis Services logon account have access permissions on the Data folder in the new location.
-
If you configure multiple partitions for one or more measure groups, and store these partitions in a separate folder structure, you must make sure that only members of the Administrators local group and the Analysis Services logon account have access permissions to this folder structure, to prevent unauthorized users from obtaining access to the Analysis Services data in these partitions.
-
If you log execution traces to a location other than the Log folder, you must similarly restrict these traces because sensitive information may be captured in such traces.