ECN-ET Common Repository and Security

Transcription

1 EUROPEAN COMMISSION Competition DG Registry and Resources Information Technology ECN-ET Common Repository and Security User Manual Commission européenne/europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel Office: J /066

2 Content 1. INTRODUCTION The product The user manual Definitions, acronyms and abbreviations USING THE SOFTWARE Introduction Purpose of the software What it does and what it does not do User level and implications Invoking the software Interface elements How to manage documents, folders and news alerts ADMINISTRATION Administration tasks Change folder's permission Create/update user Create/update profile Unlock user's account Lock user's account Reset access matrix of a user Troubleshooting tasks Reset matrix of users TROUBLESHOOTING Errors Unknown mime type Folder name already exists Folder is not empty Sorry, you have no access to delete this folder You are not allowed to delete e+ documents Security code from user matrix is not provided/valid

3 1. INTRODUCTION 1.1. The product ECN-ET is a common repository of case-related and policy documents, therefore enhancing the communication between European Commission and National Competition Authorities, speeding up the delivery of the documents and improving the efficiency of the ECN network The user manual The user manual is addressed to the users of the ECN-ET system. The document is focused on explaining how the system should be used in order to accomplish the user's goals. After describing the interfaces, the current document presents the existing types of users and how they should use the system. The document describes also administration functionalities. The last chapter Troubleshooting the focus is on how the system reacts in faulty conditions: what are the messages the user receives, what do they mean, and what are the next steps the user should follow Definitions, acronyms and abbreviations DG COMP ECN ECN-I Natacha ECN-ET ADO PKI Directorate General for Competition European Competition Network European Competition Network Interactive. It is a software tool developed by DG COMP and used by the national competition authorities to manage antitrust investigations which involve the participation of DG COMP Software tool developed by DG COMP used internally to manage antitrust investigations and court cases European Competition Network - Electronic Transmission. It is the name of the system being presented Authorised Disclosure Officer Public Key Infrastructure e+ Encryption + is for encrypted documents NCA ECAS HT COM National Competition Authority European Commission Authentication Service Horizontal Task Commission 3

4 2. USING THE SOFTWARE 2.1. Introduction Purpose of the software ECN-ET is a tool for national competition authorities and the European Commission DG Competition. It is used for storing and sharing documents in a highly secured way What it does and what it does not do ECN-ET stores documents in folders, allowing users to search and browse for documents. It provides a default configuration for the folders tree, allowing changes to the authorized users only. Documents are stored in a common repository. The access to folders and documents is defined by the system administrator based on user profiles and NCAs. Users can upload and/or download documents according to their profiles. By default, the system accepts a limited number of document types (Plain Text, Adobe PDF, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, JPEG, PNG, TIFF, MP3, Zip, 7zip). When uploading a document, depending on the confidentiality of the information, the user can choose to apply an extra security mechanism called encryption+, or e+ which will tell the system to encrypt the document before storing. On request, users can receive notifications regarding activity (update folder's properties, upload, download documents, etc.) on folders. The ECN-ET system does not send notifications in the moment the action happens (except customised notifications to the DG COMP registry). Therefore each user has to subscribe to RSS notifications for each desired folder and read RSS feeds each time he/she needs to be updated User level and implications The system can only be accessed by registered users. Each user is a member of an NCA or the Commission. Before being registered to ECN-ET, every user needs an ECAS account. Users will self-register to ECAS on by filling in the form below. 4

5 Figure 1 Depending on his/her profile, a user can upload documents. Access to folders is granted through user profiles. Any user can have many profiles. Download access is granted to users based on combination between profiles and their NCAs/DG COMP. The system administrator is responsible to maintain proper functionality of the system. He is in charge to manage: folders structure including access permissions for profiles user profiles user's accounts In addition, users from NCAs who have the relevant profile are in charge to carry out the following responsibilities: create new subfolders under existing folders create/delete accounts for users of their authority and manage these user profiles create security matrices for users of their authority 5

6 The principle according to which profiles are allocated is a 'need to know' basis. In addition, for Member State-specific profiles (such as Inspection contact points), a user only has a profile limited to his/her own Member State. The following table provides an overview of the most important user profiles and their access level in ECN-ET 1 : ECN System Administrator (e+) ECN ADO Antitrust / ECN ADO Merger (e+) DG COMP ECN Hearin g Officer (e+) COMP meetings Chairs of ECN working groups/ subgroup s ECN Brief/Newsl etter Leniency/Ins pection/ex officio contact point (e+) NCAs and DG COMP Member of ECN Sectorial and/or Working Groups 2 (e+) ECN Plenary Members (e+) ADO (e+) ECN Local Administrator 3 Art 11(2) RW RW RW RW NA NA NA NA NA R NA R 4 Art 14 RW R RW RW NA NA NA NA NA R NA R 2 Art 11(4) & 11(5) RW R NA NA NA NA NA NA NA RW 5 NA R 2 ESA user 1 N.B. There are currently more than 30 different access levels in ECN-ET. For a complete overview, use a report as provided for by ECN-ET. 2 There will be about 16 users groups which will access to the folder structure under "Horizontal Tasks\Working Groups and Sectoral Groups" structure. These user groups will have access to their correspondent folder. 3 The NCA Local Admin only has the right to create/delete accounts/modify profiles/create matrices for users of his/her authority 4 Only for cases with EEA relevance. 5 The ADO in NCA will have only access to the documents of his/her NCA 6

7 HT\ECN Plenary Meetings HT\Working Groups HT\Sectoral groups Early cooperation ECN Brief/Newsle tter RW R NA R NA NA NA NA RW R NA R RW R NA R RW NA NA RW RW(only WG "Coopera tion Issues", also BS); all other WGs: NA R NA R RW R NA R RW NA NA RW NA R NA R RW R NA NA NA NA RW NA NA NA NA NA NA NA NA NA NA RW NA NA NA NA NA NA Legend: HT is Horizontal Task, R is read access and W is right access (upload, rename, delete documents), NA is no access, e+ access on encrypted+ documents 7

8 Invoking the software Interface elements Figure 2 Figure 3 8

9 Figure Login screen (Figure 2 and Figure 3) The ECN-ET login box is leading the user to the ECAS login screen (Fig. 1 B). After successful authentication, ECAS is automatically redirecting the user to the last visited page on ECN-ET Logout button (Figure 4, element 1) This button is present on every page. By pressing the log out button, the user's session is reset. Next time when the user logs in, the system will redirect him/her to the last page visited User Manual (Figure 4, element 2) This button is present on every page. It lets the user download a PDF version of this manual Free text box search (Figure 4, element 3) This button is present on every page. It allows the user to type text to search. The system displays the search result while the user types. The items found are grouped by type: folders, documents, users. By choosing a found item from the list, the user is redirected to the proper page of the found item Main menu Documents tab (Figure 4, element 3) This feature is available on every screen of ECN-ET. 9

10 (a) Toolbar (Figure 4, element 4) (detailed view, Figure 5) Figure 5 Located on the left top corner above the 'Documents' tab. It includes buttons for: Upload new document (Figure 5, button 1). When clicked, it opens the "Document upload" dialog window (Figure 6). Interface elements: Title: "Upload document". Close button: top right corner. Description: Text describing the document to be uploaded. Max length = 2000 characters. Importance: Normal or High. e+: flag indicating to the system that the document should be encrypted before storing. Select File allows the user to select the file to be uploaded on the local computer. Access control: List of the existing NCAs which will be able to access the document. The NCA of the user uploading the document is selected by default and it can't be unchecked. Close allows the user to close the Upload Window. Upload File will start the process of uploading the selected file on the server. This action has to be done after all necessary info is filled in. The user will receive a confirmation by mail when the file has been uploaded. 10

11 Figure 6 Update document (Figure 5, button 2). When clicked, if the focus is on a document, the "Update document" dialog window is displayed (Figure 7). Interface elements: Title: "Edit document properties". Close button: top right corner. File name: Complete file name, including file extension. Path: Path to the document in ECN-ET. Description: Text describing the document to be uploaded. Max length = 2000 characters. Importance: Normal or High. e+: flag telling to the system that the document will be stored encrypted. Access control: List of the existing NCAs which will be able to access the document. The NCA of the user uploading the document is selected by default and it can't be unchecked. Save will save the changes. Cancel will cancel the changes. 11

12 Figure 7 [I would suggest to put this part on hold until after our meeting].archive a document (Figure 5, button 3). Allow the user to archive documents. This feature is only enabled for the "Archiver" profile. Figure 8 Send a message (Figure 5, button 4). When clicked, it opens the "Send a message" dialog window (Figure 8). Interface elements: Title: "Send message". Close button: top right corner. Message: the message. 12

13 Importance: Normal or High. e+: Flag indicating to the system that the document should be encrypted before storing. Access control: List of the existing NCAs which will be able to access the document. The NCA of the user uploading the document is selected by default and it can't be unchecked. Save will upload the message. Cancel will close the dialog. Figure 9 Edit a message (Figure 5, button 5). When clicked, it opens the "Send a message" dialog window (Figure 9). Interface elements: Title: "Edit message properties". Close button: top right corner. File name: always "Message ". Path: Path to the message in ECN-ET. Importance: Normal or High. Access control. List of the existing NCAs which will be able to access the document. The NCA of the user uploading the document is selected by default and it can't be unchecked. Save will save the changes. Cancel will cancel the changes. 13

14 Create new folder (Figure 5, button 6). When clicked, if focus is on an existing folder, it opens the "New folder" dialog window (Figure 10). It will allow the user to create a subfolder under the currently selected folder. Interface elements: Title: "Folder properties". Close button: top right corner. Tab Folder properties (Figure 10): Display name (mandatory): name of the folder. Locked: subfolders cannot be created or edited.folder name and properties can only be modified by specific profiles (level 7) Description: Text describing the purpose of folder. Max length = 2000 characters. e+: Flag indicating to the system that the documents stored under the current folder will be encrypted. Tab Access control (Figure 11): Profile: list the profiles defined for the Application Override inherited: when ticked, allow the user to override the default access level which has been defined on the parent folder. Access level: shows the default access level for that folder or the overridden access level. Save will save the changes. Cancel will cancel the changes. 14

15 Figure 10 Figure 11 Update selected folder (Figure 5, button 7). When clicked, if a folder is selected, it opens the "Update folder" dialog window which will allow the user to update the currently selected folder. Delete selected folder (Figure 5, button 8). When clicked, if a folder is selected, the system will ask for confirmation before deleting the folder. If the folder is not empty (it contains subfolders or documents), the folder is not deleted and user will be informed. Archive selected folder (Figure 5, button 9). Allow the user to archive a folder. This feature is only enabled for the "Archiver" profile. 15

16 Subscribe/unsubscribe to alerts (Figure 5, button 10). Allows the user to subscribe to the alerts service of the system. To subscribe, one user needs to select the folder on which he/she needs to be notified when certain actions occur and click this button. The system displays a confirmation message. The user will receive notifications via RSS feeds on the events occurring on the selected folder and all its subfolders. The notified events occurring on the subscribed folder or any of its subfolders, are: Updates on the subscribed folder or any of its subfolders. Create new folders in the subscribed folder or any of its subfolders. Delete of the subscribed folder or any of its subfolders. Upload of documents. Download of documents. Delete of documents. Show my RSS (Figure 5, button 11). When clicked, the user gets the RSS link he/she will use with its preferred RSS reader, in order to get notifications on the folders for which he/she subscribed. (b) Folder's tree (Figure 4, element 5) It allows a browsing user experience similar to windows explorer on windows machines. Red colour of folder name represents protected system area users are not allowed to add subfolders or edit the current folder without explicit permissions. Icons are used to depict properties of the folders: Folder which is not encrypted and the logged in user did not subscribe to the alerts service. e+ folder. Folder for which the currently logged in user subscribed to the alerts service. Encrypted folder for which the user subscribed to the alerts service. 16

17 (c) Document's table (Figure 4, element 6) (detailed view, Figure 12) Figure 12 Columns of the table: Importance has been set to "High". No icon means that the Importance has been set to "Normal". e+: the document has been encrypted ( ) or not ( ). File name: includes the file extension. Description: document's details. Created: date and time when the document was created. Last updated: date and time when the document was last updated. Icon representing the type of the document. NCAs who have access to this document/message Download: download the document/message. Delete: delete the document/message. If it's encrypted, a code will be requested from then personal security access matrix Main menu Administration tab (Figure 4, element 3) This feature is available on every screen of ECN-ET if the user has been assigned the corresponding profile. 17

18 Figure 13 (a) Toolbar (Figure 13, element 1) (detailed view Figure 14) Figure 14 Located on the left top corner above the Documents' tab. It includes buttons for: New user (Figure 14, button 1). When this button is clicked, the form below (Figure 15) is displayed. Interface elements: ECAS login (mandatory): in order to be registered into the ECN-ET system, the user must have a valid ECAS login name. Full name. Phone. (mandatory). Address. NCA (mandatory). Status: When enabled, the user can log in to the system. When disabled, the user can't log in. User profiles: table in chapter shows each profile's access rights. Save will save the changes. Cancel will cancel the changes. 18

19 Figure 15 (b) Tree menu (Figure 13, element 3). When the user navigates using the tree menu, the content of the page (Fig. 8, zone 4) changes according to the context. (c) User's details (Figure 13, element 2). (d) Profile details (Figure 13, element 4) Main menu Upload history tab (Figure 4, element 3) This feature is available on every screen of ECN-ET if the user has been assigned the corresponding profile. Figure 16 This is the internal ECN-ET RSS reader which allows users to consults the RSS alerts on the folders they have subscribed (see ) How to manage documents, folders and news alerts Create folder Permissions required: the user needs to have a profile which allows "Manage subfolders" on the destination folder (where the new folder will be created). 19

20 After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 2. Click "Create new folder" button (Figure 5, button 6). 3. Setup the folder's properties (Figure 10 and Figure 11). 4. Click the "Save" button Update folder Permissions required: the user needs to have a profile which allows "Edit folder" on the target folder (folder to be updated). In order to change value of the "Lock" field, the user needs to have a profile which allows "Edit system protected". In order to change value of the "e+" field, the user needs to have a profile which allows "Edit e+". In order to change value of the "External application" field, the user needs to have a profile which allows "Edit external apps.". After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 2. Click "Update selected folder" button (Figure 5, button 7). 3. Update the folder's properties (Figure 10 and Figure 11). 4. Click the "Save" button Delete folder Permissions required: the user needs to have a profile which allows "Manage subfolders" on the parent of the target folder (the folder to be deleted). The folder to delete has to be empty. After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 2. Select the target folder. 3. Click "Delete selected folder" button (Figure 5, button 8). 4. Confirm when asked Upload a document Permissions required: the user needs to have a profile which allows "Upload documents" on the destination folder (where the document will be uploaded). After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 20

21 2. Click "Upload new document" button (Figure 5, button 1). 3. Browse the local machine for the file to be uploaded. 4. Fill in the document's properties. 5. Click the "Save" button Upload a message Permissions required: the user needs to have a profile which allows "Upload documents" (same as above) on the destination folder (where the message will be uploaded). After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 2. Click "Upload new document" button (Figure 5, button 5). 3. Fill in the message's properties. 4. Click the "Save" button Download a document Permissions required: the user needs to have a profile which allows "Download documents" on the destination folder (where the document to be downloaded is stored). After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 2. Click the "Download" button for the desired document. 3. When asked, save the document. "Save" will save the document into the "Downloads" folder. "Save as " will allow you to browse your local computer for a place where the file will be saved Download an e+ document Permissions required: the user needs to have a profile which allows "Download documents" on the destination folder (where the document to be downloaded is stored) and "Access to e+ documents" access rights. After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 2. Click the "Download" button for the desired document. 3. When asked, provide the requested key (Figure 17) from the personal security access matrix (Figure 18). 21

22 4. When asked, save the document. "Save" will save the document into the "Downloads" folder. "Save as " will allow you to browse your local computer for a place where the file will be saved. When requested, if the user enters wrong code for three times in a row, (s)he is logged out automatically and the user's account will be locked. To be able to log in again, the user must ask the system administrator to unlock his/her account Download a message Permissions required: the user needs to have a profile which allows "Download documents" on the destination folder (where the document to be downloaded is stored). After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 2. Click the "Download" button for the desired document. 3. A dialog containing the message will pop up Download an e+ message Permissions required: the user needs to have a profile which allows "Download documents" on the destination folder (where the document to be downloaded is stored) and "Access to e+ documents" access rights. After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 2. Click the "Download" button for the desired document. 3. When asked, provide the requested key (Figure 17) from the personal security access matrix (Figure 18). 4. A dialog containing the message will pop up. When requested, if the user enters wrong code for three times in a row, (s)he is logged out automatically and the user's account will be locked. To be able to log in again, the user must ask the system administrator to unlock his/her account Subscribe to the alerts service Permissions required: any registered user has access to this functionality. After logging in, the user has to perform the following steps: 1. Browse to the destination folder (Figure 4, element 4). 2. Select the folder. 22

23 3. Click the "Subscribe/unsubscribe to alerts" button (Figure 5, button 10). 4. Confirm when asked Read alerts Permissions required: any registered user has access to this functionality. The user needs to: have an RSS reader installed on his computer, or to use an online RSS service, or go to the Upload History tab (see ). After logging in, the user has to perform the following steps: 1. Click "Show my RSS" button (Figure 5, button 11) 2. Copy/paste the URL from the new opened window to your preferred RSS reader. 23

24 3. ADMINISTRATION 3.1. Administration tasks They are performed by the system administrator and NCA users with the relevant profile. They involve: Change folder's permission Permissions required: the user needs to have a profile which allows both "Edit folder" and "Edit security" on the target folder (the folder to be updated) and "Access to e+ documents" access rights. After logging in, the user has to perform the following steps: 1. Browse to the target folder (Fig. 2, element 5) 2. Click "Update selected folder" button (Fig. 3, button 4) 3. Edit folder's security matrix 4. Click "Save" button Create/update user 6 Permissions required for the user who performs the action: he/she needs to have a profile which allows access to the "Administration" interface screen. After logging in, the user has to perform the following steps: 1. Click "New user" button (Fig. 9 button 1) or browse to the target user (Fig. 8, element 3) if updating 2. Update user's properties 3. Click "Save" button Create/update profile Permissions required for the user who performs the action: he/she needs to have a profile which allows access to the "Administration" interface screen. After logging in, the user has to perform the following steps: 1. Click "New profile" button (Fig. 9 button 2) or browse to the target profile (Fig. 8, element 3) if updating 2. Update profile's properties 3. Click "Save" button 6 Note that NCA Local Administrators can only perform this function as well as the functions described under 3.1.3, 3.1.4, and for users of their authority. 24

25 Unlock user's account Users' accounts are locked automatically by the system when three unsuccessful attempts of entering the security code from the personal matrix (Figure 18). Steps performed by the system administrator to unlock user's account: 1. Browse to the target user (Figure 13, element 3). 2. Select the user. 3. Update the "Status" field by selecting "Enabled". 4. Click the "Save" button Lock user's account The administrator should lock user's account only when the access of the user into the system has to be suspended. Steps performed by the system administrator to lock user's account: 1. Browse to the target user (Figure 13, element 3). 2. Select the user. 3. Update the "Status" field by selecting "Disabled". 4. Click the "Save" button Reset access matrix of a user Permissions required for the user who performs the action: he/she needs to have a profile which allows access to "Administration" interface screen. The target user needs to have a profile which allows "Access to e+ documents". After logging in, the user has to perform the following steps: 1. Browse to the target user (Figure 13, element 3). 2. Select the user. 3. Click "Reset matrix button". 4. When asked, provide the requested key (Figure 17) from the personal security access matrix (Figure 18) and press OK. While generating the new security matrix, the system will automatically generate and send to the target user the password for it (Figure 19 displays a sample ). 5. Save the new security matrix as PDF on the local computer. 6. Send the PDF file as attachment via a secure (PKI) to the target user (the address specified in Figure 15). 25

26 Figure 17 John Doe Figure 18 XXXXXXX Figure 19 N.B. indicates that a user matrix has not yet been created Troubleshooting tasks They are performed by the system administrator. They involve: It's mandatory to do it: Reset matrix of users On the user's request, when the user suspect its matrix was compromised, in order to protect the existing encrypted content of ECN-ET. For all the users having already a valid security matrix, after the initialization of the application security is performed. 26

27 Resetting the user's security matrix, preserves the access of the user to the existing encrypted content. For how to do it, please, read chapter

28 4. TROUBLESHOOTING 4.1. Errors Error messages displayed by the system in faulty conditions: Unknown mime type The error is displayed when a document is uploaded and the system does not know the mime type of the file. When deployed, the known mime types are: PDF, Image (.jpeg,.jpg,.png,.tiff), Plain text (.txt), Microsoft Office Document (.doc,.docx,.xls,.xlsx,.ppt, pptx), Zip (.zip,.7z,.001,.002,.003,.004 up to.010), Audio files (.mp3) Please, check the file type. If you consider the system should support uploading the desired file type, contact the system administrator Folder name already exists It is displayed when saving a folder. It means there is already a folder having the same name under the same parent folder. The system does not allow duplicate names for folders under the same parent. Please, correct the error and try again Folder is not empty It occurs when the user tries to delete a folder which is not empty. The system does not allow deletion of non-empty folders. Please, delete the content first, and try again Sorry, you have no access to delete this folder It occurs when a user with no proper access rights tries to delete a folder. Please, contact the system administrator You are not allowed to delete e+ documents It occurs when a user with no proper access rights tries to delete an e+ document. Please, contact the system administrator Security code from user matrix is not provided/valid The action the user performed is against the security mechanism of the ECN-ET system. Please, contact the system administrator 28