Policy Handbook for IBM Connections Cloud Collaboration Platform

Transcription

1 Policy Handbook for IBM Connections Cloud Collaboration Platform Introduction Policy Precedence for IBM Connections User Stories Feedback Vantage simplifies management and compliance for enterprise communication and collaboration. It gives granular policy control over your infrastructure, in some cases right down to the feature level. With such extensive coverage and level of control, Vantage provides the best solution to address strict compliance requirements including those set by the SEC, FINRA, IIROC, PRA, FCA, FERC, DOE, EPA, FDA, HIPAA, and other key regulatory bodies. Vantage is available in On-Premise and On-Cloud deployments.

2 Legal Notices and Disclaimer This section discusses the copyrights, software license notices, and disclaimers. Copyright Copyright , Actiance Inc. All rights reserved. Not for use or distribution without the express permission of Actiance. Actiance, the Actiance logo, Vantage, and Vantage Manager are trademarks of Actiance, Inc. in the United States and other countries. All other names mentioned in this document may be trademarks of their respective owners. Information subject to change at any time. Software License Notice The software described in this publication is furnished under license and may only be used or copied in accordance with the terms of such license. The license agreement with Actiance specifies the permitted and prohibited uses of the product. Any unauthorized duplication or use of Actiance software in whole or in part, or in any other storage and retrieval system, is prohibited. This document is not for use or distribution without the express permission of Actiance. This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or converted to any electronic or machine-readable form without the prior written consent of Actiance, Inc., 1400 Seaport Blvd., Building B, Third Floor, Redwood City, CA USA. Documentation Disclaimer Network features that are not listed in this document are not supported on Vantage. Sample XML files and field values are provided as examples only. You are responsible for identifying the security options appropriate to the risks identified in your environment. The third-party URLs in this guide are not owned or controlled by Actiance. Actiance is not responsible for the content, and trademarks used in these websites. Accessing or use of thirdparty websites is entirely at your own risk. Actiance reserves the right to revise this publication and may modify content without notice. Contact Actiance Technical Support for the latest updates. No part of this document may be copied or reproduced without prior written permission of Actiance.

3 Preface Vantage provides granular policies to enable real-time control over 70+ communications channels. With this breadth of coverage and level of control, Vantage provides a solution to address the most rigorous SEC, FINRA, IIROC, MiFIDII, and FCA compliance requirements as well as the requirements outlined by FERC, DOE, EPA, FDA, and HIPAA. Vantage captures, manages, and secures unified communications, enterprise social software, and instant messaging in a way that meets the most demanding compliance and regulatory requirements. Audience This guide is intended for solution architects who have in-depth knowledge of the enterprise architecture and administrators who set policies to monitor communication on collaboration platforms. Conventions Used in this Guide The following tables describe the conventions and terms used in this guide: Table: Text Conventions Conventions Bold <Italics> Code "Message" Description Indicates User Interface (UI) elements such as text boxes and menu items. For example, the Configuration tab. Indicates variables that need to be substituted with the actual values. For example, <Your URL>. Your URL needs to be replaced with an appropriate URL. Indicates commands and arguments that you need to use at a command-line interface. Indicates a message on the User Interface.

4 Table: Graphical Conventions Conventions Description» Indicates the sequence of menu items that you need to select for accessing a UI page. For instance, IM tab» Edit Global IM Policy means click the IM tab, and then click Edit Global IM Policy Note Represents a note. Important Represents an important note. Represents a caution. Notes: - This guide may contain URLs for third party websites that are not owned or controlled by Actiance. The URLs for these third-party websites may change or become inaccessible after publication of this guide. The content and trademarks contained in such websites are the property of their respective owners, and Actiance is not responsible for that content. Your access or use of any third-party website is entirely at your own risk. - Interactions, transcripts, and conversations are used synonymously in this guide. Related Documents See the Vantage System Administrator s Guide for information on configuring the various Vantage features. See the Vantage User s Guide for information on using the Vantage Reviewer s UI. See the Vantage Server Properties Handbook for information on server properties.

5 Introduction In today's world, excellence is achieved in delivering services when employees within the enterprise are permitted to identify one another, communicate, and share knowledge. A collaborative platform enables employees within an enterprise to communicate and work together to achieve a common goal. The potential use of enterprise collaboration platforms as a communication medium with wikis, blogs, and discussion forums can pose risks to organizations. Vantage enables you configure collaboration policies to: Provide selective usage access for collaboration features. Enable archiving and monitor content posted. Enable content review for any regulatory violations. Track employee s activity on collaboration platforms. Supported Enterprise Collaboration Platforms Vantage helps you configure policies and track employees activities for IBM Connections Social Cloud enterprise collaboration platforms. Types of Events Vantage supports auditing for events that are generated when the following actions are performed on the collaboration platforms: Create content Update content Delete content

6 When can I use Collaboration Policies? Vantage supports the archiving of policies for collaboration platform deployment. You can set the following archiving policies for actions performed by employees in organization who use IBM Connections Social Cloud: Archive blog posts and forums. Monitor employee activities on collaboration platforms. Archive wiki pages between teams. Archiving Policies for Collaboration Platforms It is essential to monitor the content posted on collaboration platforms for the following reasons: Employees may leak sensitive information about the company through a post. Corporate accounts holders may use inappropriate language in their posts. Vantage provides archiving policies that enable you to perform the following functions: Archive content changes such as posting, editing, and deleting by participants on a collaboration platform. Recognize and flag content upon a lexicon match. Notify administrator(s) when employees post content on the collaboration platform. Archive content for long term storage by inter-operating with enterprise archival systems and for an easy retrieval process.

7 Understanding Policy Precedence for IBM Connections This chapter provides information about how the Server employs logical order for policy evaluation for various user events. Policy Precedence Vantage employs logical order for collaboration policy evaluation. The policy precedence is as shown: 1. Group-Specific Policy: This policy is configured from the policy wizard. The settings specified here will take precedence over the Connections Default Policy. In the case of multiple group-specific policies, the most permissive policy settings will take precedence. If no group-specific policy is defined, then the defined Connections Default policy will be applicable. 2. Connections Default Policy: By default, there are no policy rules established. Vantage captures traffic for employees based on their default logging setting. This policy is determined based on the configured global, group, and/or employee level logging settings. By default, no Archiving Settings options is specified in the policy wizard. 3. Vantage applies Audit Conversation Permissions in the following order: Employee level, Group Level and Global User Default Permissions. Supported Features for IBM Connections Vantage supports the following managed content types for IBM Connections: Bookmarks Activities Forums Wikis Blogs Profiles Home Files Libraries Auditing of create, update, delete events in a Community is managed by Audit Conversation permission at the User & Group Defaults page under Configuration tab. where as

8 Auditing of other Application events inside the Community is managed by policies configured from the Policies tab in the policy wizard. For example, events inside the community for blog, wiki, forum, bookmarks are managed by policies configured under the Policies tab in the policy wizard. IBM connections version should be Connections 4.5CR2 with Fixpack2 applied on File Net server(connections content manager) for supporting Connections Content manager events.

9 User Stories for IBM Connections This chapter provides few user stories, examples, and resolutions for various policy definition. Auditing Policy for Group Policy Definition Archiving compliance is not required for members of the Management group in an organization. Configuration Summary 1. Administrator configures a group policy, Management Policy, and includes all resources. 2. Administrator adds the Management group to this policy using the Add selected Group(s) to this Policy icon in the policy wizard. 3. Administrator configures Archiving Settings to Don t Audit option against all the features. Table: Auditing Policy Enforcements for a Group Questions Answers Who are Actors? All employees belonging to the Management group. What Policy is Applicable? Why is this Policy Enforced? Group policy settings for Management group is applicable. As this is the only applicable policy, Vantage enforces the Management policy. Examples This section provides examples for various policy definition. Enterprise Compliance with Management Exclusion Policy Definition Compliance is required for all groups in enterprise except for Chief Executive Officer (CEO), Human Resources Manager (HR) and Country Head (CH) groups. Configuration Summary 1. Administrator configures the following options: a. Sets Audit Conversations permissions to Yes under the User & Groups Defaults page from the Configuration tab in the administrative user interface. b. Sets Archiving Settings to Audit for all features under the Connections Default Policy in the policy wizard.

10 2. Administrator creates, Management policy, a group policy from the policy wizard for CEO, HR and CH groups and configures Archiving Settings to Do not Audit for all features. Result 1. For any action performed by employees who do not belong to the CEO, HR and CH groups, Vantage applies the Connections Default Policy. 2. For any action performed by employees from CEO, HR and CH groups, Vantage applies Management policy and hence their actions are not audited. Granular Compliance for Enterprise Interns Policy Definition Compliance is required for blog activities and file operations for Sales and Procurement intern groups. Configuration Summary Administrator creates, Intern, a group policy from the policy wizard with Sale and Procurement intern groups and configures Archiving Settings to Audit for Blog and Files features. Result Any action performed by employees in Sales and Procurement intern groups, Vantage applies Intern policy and hence blog and file operations are audited.

11 Granular Compliance for Enterprise and Vendors Policy Definition Compliance is a necessity for vendors group using Applications. Configuration Summary 1. Administrator creates, Vendor policy, a group policy with Contractors group and configures Archiving Settings to Audit for all Applications. 2. Administrator configures Archiving Settings to Don t Audit for all features under the Connections Default Policy in the policy wizard. Result For any action performed by vendors, Vantage applies Vendor policy. For all actions performed by employees of any group other than the vendor group, Vantage applies the Connections Default Policy. Granular Compliance for Enterprise Policy Definition Audit the posts on Forums by employees belonging to both analysis and trading departments. Configuration Summary 1. Administrator creates, Analyst policy, a group policy with Analyst and Traders groups and configures Archiving Settings to Audit for Forum. 2. Administrator configures Archiving Settings to Audit for all features under the Connections Default Policy in the policy wizard. Result For any action performed by employees of Analyst group, Vantage applies Analyst policy. For any action performed by employees of any group other than above two groups, Vantage applies the Connections Default policy. Category: Policy resolutions for same type of policies with various assigned permissions. The following table below indicates few important combinations of resource policies for various assigned permissions. All these policies are configured for a single group. The policy resolution rules described in the table below are also applicable for Group Policy and Priority Policy. Table: Policy Configuration Resource Policy Permission Assigned Resolution Rules Policy1 (P1) File Upload - Audit - Yes Either Policy1 (P1) or Policy2 (P2) Policy2 (P2) File Upload - Audit - Yes is enforced. Policy3 (P3) File Upload - Audit - Yes Policy3 (P3) is enforced.

12 Policy4 (P4) File Upload - Audit - No Vantage applies a permissive merge permissions. Policy5 (P5) File Upload - Audit - No Either Policy5 (P5) or Policy6 (P6) Policy6 (P6) File Upload - Audit - No is enforced. Vantage applies permission that performs no auditing. Policy7 (P7) File Upload - Audit - Yes Policy7 (P7) is enforced. Policy8 (P8) Vantage applies a permissive File Upload Permission- Not merge permissions. Defined Policy9 (P9) File Upload - Audit - No Policy9 (P9) is enforced. Policy10 (P10) File Upload Permission- Not Defined Things You Should Know 1. Policy name cannot contain the same name as a group name or inter group policy name. 2. A policy containing All Groups and All Resources cannot be created. 3. Modifications made to usage controls settings takes approximately 30 minutes to take effect.

13 Send Documentation Feedback If you have comments about this document, you can contact the documentation team by . If an client is configured on your system, click the link above and an window opens with the following information in the subject line: Feedback on the Vantage XML Imports Guide Add your feedback to the body and click Send. If no client is available, copy the information above to a new message in a web mail client, and send your feedback to docfeedback@actiance.com. For product related queries, please contact Actiance Support. We appreciate your feedback!