SECURITY CONFIGURATION EXAMPLE: INDIVIDUAL ADVISORS WITH ACCESS CONTROLLED BY ROLES AND TENURE

Transcription

1 SECURITY CONFIGURATION EXAMPLE: INDIVIDUAL ADVISORS WITH ACCESS CONTROLLED BY ROLES AND TENURE At its core, the Security Rights and Roles module gives you the ability to control the access to certain information, and the activities you can take with those portfolios. In the Individual Advisors scenario, only users in a data entry, operations or system role have access to all the portfolios in the database. The Advisors can only see their client lists. The limitation placed on the users is based on both the segmentation of the portfolios as well as what each user can do to or with each portfolio in the database, based on his or her responsibilities. This document will show you, step by step, how to create the Individual Advisor scenario by describing the scenario, any groups used in the scenario, which security profiles to use, on what level to apply security for each role. DESCRIPTION OF INDIVIDUAL ADVISORS At its most basic, the Individual Advisors scenario segments the portfolios for each advisor, but all users supporting the advisors can see all the portfolios. Limitations placed on the data are both what can be seen by certain users, as well as what each user can do with the data. The most common users of this example will be firms with multiple advisors, but a single team of data entry, operations and/or system support staff. In this particular example, we ll take the Rick Davis firm. There are 10 employees, including three advisors, four data entry employees, one operations employee and two systems employees. Below is a list of those employees and a little bit of their background. Rick, Kate and Adam Firm advisors who run reports and meets with their respective clients. Mike and Stephen the IT/Systems employees whose primary responsibility is to manage security and systems. Maria the receptionist, who occasionally will look up information for users, but rarely uses PortfolioCenter. Sally the manager of the data entry operators, who are primarily responsible for posting and reconciling data and preparing reports for client meetings. She has been with the firm since it opened and is very familiar with the program and the firm s processes. Ashley, Emily and Ryan the data entry operators who are primarily responsible for posting and reconciling data and preparing reports for client meetings. DocumentID: SPT Last Updated: April 22, 2013

2 In this situation, we will create five groups: Advisors Rick, Kate and Adam will be the members of this group and will be assigned basic reporting capability with a little bit of data entry (add) on the database level. System Administration Mike and Stephen will be the members of this group. They will have the ability to view some types of data and run reports, as well as administer security. Reporting Maria will belong to this group and will have the ability to run reports and change settings, but no data entry functionality. Data Entry (Experienced Employees) Sally will belong to this group and will have the ability to run reports and view, enter, edit and delete any data as needed. Data Entry (Newer Employees) Ashley, Emily and Ryan will belong to this group and will have the ability to view, enter and edit data and run reports, but cannot delete any data. Note Groups are not required for this scenario. However, creating groups makes handling changes to roles, employee turnover and changes to configurations much easier to manage in Security Rights and Roles. See Creating and Managing User Groups for more information about when and why to use User Groups in Security Rights and Roles. CONFIGURING SECURITY RIGHTS AND ROLES FOR THE FIRM Configuring Security Rights and Roles for this firm will happen in five steps: 1 Create the Users. See the Creating the Users section starting on page 3 for the steps. 2 Create the Groups. See the Creating the Groups section starting on page 4 for the steps. 3 Create the Security Sets you want to use for each advisor and move the appropriate contents into each security set. See the Creating Security Sets and Defining their Contents section starting on page 5 for the steps. 4 Select, edit or create the Security Profile(s) you want to use for each Group. See the Selecting/Editing the Security Profiles for Each Group section starting on page 7 for the steps. 5 Apply Security Profiles to the appropriate groups on the Database level, and then apply security profiles and advisors to the appropriate Security Sets. See the Applying the Security Profiles to the Groups on a Global Level and Advisors on the Security Set Level section starting on page 9 for the steps. 6 Test permissions and rights on the Effective Permissions tab. See the Test Security Profiles section starting on page 11 for the steps. Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 2 of 11

3 CREATING THE USERS Using the following steps, we will create the user Kate Murphy. Repeat the steps below for each user you need to create. 1 Open the PortfolioCenter Management Console and login to Security Administration: Start All Programs Schwab Performance Technologies PortfolioCenter Management Console 2 Right-click on the Users icon and select Create New User from the menu, as shown to the right. You can also click the New button on the bottom right of the window. 3 On the General Tab, enter data for the following fields: Login ID: This is the ID the user will enter each time the login to PortfolioCenter or the Security Administration Console. First Name: User s first name Last Name: User s last name Phone Number: User s phone number. Can be any phone number for the user. Address: User s address. Can be any address for the user. Description: any description you want to assign to the user. Initial Password: any starter or initial password you want to assign to the user. Confirm Password: retype the starter or initial password. Account Active Checkbox: check this box to indicate that the account is active. It should be checked by default. Locked Out Checkbox: this box should only be checked if the user attempted and failed login more than three times. Leave this box unchecked. Allow Multiple Logins Checkbox: check this box if you want the user to have the ability to login to PortfolioCenter on more than one computer at a time. Must Change Password Checkbox: check this box if you want the user to be forced to change the initial password when they first login to PortfolioCenter. 4 Click Apply to save the changes. 5 Repeat all these steps for each user you want to create. Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 3 of 11

4 CREATING THE GROUPS Using the following steps, we ll create the Reporting group. Repeat the steps below for each group you need to create. 1 Open the PortfolioCenter Management Console and login to Security Administration: Start All Programs Schwab Performance Technologies PortfolioCenter Management Console 2 Right-click the Groups icon and select Create New Group from the menu. 3 On the General tab, enter a group name and group description, and then click the Apply button. In this example, we are calling the group Reporting Group. 4 Click the Members Tab to add the members to the group. 5 Click the Add button at the bottom of the window to open the Search PortfolioCenter Users dialog. 6 From the dialog that appears, select the users that are considered to be experienced employees, and then OK. In this example, we selected Maria. 7 Click the Apply button to save the changes for this group. 8 Repeat steps 2 through 7 until you have created all of the groups. The end result should look like the image below with the following groups: Advisors, Data Entry (Experienced Employees), Data Entry (Newer Employees), Everyone, Reporting and System Administration. Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 4 of 11

5 CREATING SECURITY SETS AND DEFINING THEIR CONTENTS Using the following steps, we will create the security sets. Repeat the steps below for each security set you need to create. CREATING THE SECURITY SETS 1 Open the PortfolioCenter Management Console and login to Security Administration: Start All Programs Schwab Performance Technologies PortfolioCenter Management Console 2 Click the plus to the left of the Database Security icon to expand the list of Datasets. 3 Right-click on the dataset you are using and select Create New Security Set from the menu. 4 On the right side of the split screen on the General Tab enter the name and description of the Security Set. In this example, we will name each of the Security Sets by the three advisor s names. 5 Repeat steps 3 through 4 for each Security Set you need to create. In this example, we will create two additional security sets ending up with one for each advisor. Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 5 of 11

6 MOVING CONTENTS INTO THE CORRECT SECURITY SETS After creating the new Security Sets for each advisor, you need to move the data in the Default Portfolios security set into the Security Set for the appropriate advisor. 1 Click the plus sign to the left of the Dataset to expand the list of Security Sets. You should see the Default Portfolios Security Set, in addition to the security sets you created for each advisor. 2 Click the Default Security Set to see all the portfolios and other items. 3 Select each item you want to move to the first advisor s Security Set. Press the CTRL key as you select items to select more than one at a time. 4 Click the Move To button under the list of portfolios. 5 In the Select Target Security Set window, select the name of the security set you want to move items to, and then click OK. 6 Repeat these steps until you have moved all the items you need to move Note As a best practice, use the filter functionality to limit the items that you see to only portfolios, groups, etc. This will simplify identifying and moving items to the appropriate Security Sets. Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 6 of 11

7 SELECTING/EDITING THE SECURITY PROFILES FOR EACH GROUP The Security Rights and Roles add-on module comes with nine pre-defined default Security Profiles. This particular scenario can use five of the default Security Profiles as they are, but we need to copy and modify one of them to accommodate the roles of Ashley, Emily and Ryan. Because of the various levels of security, we will apply certain Security Profiles to groups on the Database level, and then different Security Profiles to specific users on the Security Set level. The table below is the plan of which default security Profile will be used with each group and the level we plan to associate them. Online Learn more about all the default Security Profiles in the document Default Security Profiles. Also, if you need to edit the default Security Profiles, see the instructions in Creating and Managing Security Profiles. GROUP ASSOCIATION DEFAULT SECURITY PROFILE NAME SECURITY LEVEL ASSOCIATION Advisors (Rick, Kate & Adam) Reporting (System) Database Rick Reporting (Security Set) Rick s Security Set Kate Reporting (Security Set) Kate s Security Set Adam Reporting (Security Set) Adam s Security Set Reporting (Maria) Reporting Database Data Entry Experienced (Sally) Data Entry Database Data Entry Newer Employees (Ashley, Emily & Ryan) Copy of Data Entry Database System Administration (Mike & Stephen) Security Administration Database Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 7 of 11

8 EDITING THE SECURITY PROFILE FOR THE NEW USER For the experienced Data Entry user, we will apply the default Security Profile listed on the previous page at the Database level. The purpose of this part, however, is to copy the Data Entry default profile and remove the edit and delete rights to certain permissions for the newer employees. Follow the steps below to create the new Security Profile and edit it: 1 In the Security Administration Console, click the Security Profiles icon. 2 On the list of Security Profiles, select the Security Profile you want to copy, and then click the Save As button. In this example, we are making a copy selected the Data Entry Security Profile. 3 In the Save Profile As dialog, enter a new name for the Security Profile. In this example, we entered Add/View Only. 4 Click OK to save the changes. 5 The new profile opens to the General tab. Enter any additional information in the description or name as necessary. 6 Click the Apply button at the bottom of the window to save the changes and save the profile name. 7 Click the Security Rights tab for the new Security Profile. 8 Look through the list of security permissions added to this profile to ensure you have the permissions you want to grant. In this example, we are going to use the same permissions granted in the default View Only Security Profile. If you need to remove a permission, select that permission and click the Remove button. If you need to add a permission, click the Add button and select the new permission from the list. In the example on the next page, we are not going to remove or add any permissions. Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 8 of 11

9 9 To modify rights for existing permissions in the Security Profile, select the permission. The rights for the permission are listed below the list of permissions. Check or uncheck the rights you want to grant or remove. In this example, we are removing the Edit and Delete rights for the Advisors permission. 10 Repeat step 9 for each permission you want to edit in the profile, and then click Apply to save the changes. 11 Repeat all the above steps for each Security Profile you need to copy. For the security configuration example in this document, you would make a copy of the Data Entry Security Profile and remove some of the data entry permissions and rights to it. APPLYING THE SECURITY PROFILES TO THE GROUPS ON A GLOBAL LEVEL AND ADVISORS ON THE SECURITY SET LEVEL Because all of the users will have ability to see all the portfolios in the database, we will apply the security profiles at the Database level for all five groups excluding the advisor level groups right now. This section shows you how to apply security to each group. APPLYING GLOBAL SECURITY TO THE GROUPS 1 In the Security Administration Console, click the Database Security icon, and then click the Permissions tab. 2 On the permissions tab, click the Add button on the left, under the Users and Groups window. 3 From the dialog, select the Data Entry (Newer Employees) group, and then click OK. 4 With the Data Entry group selected on the left, click the Add button on the right, under the Profiles Assigned to Data Entry group window. 5 From the dialog, select the appropriate security profile, and then click OK. In this example on the next page, we have selected the new default Security Profile called Data Entry (New Employees). 6 Repeat steps 2 through 5 for each of the five groups, ensuring you associate the correct Security Profile with the correct group. 7 Select the Everyone group and click the Remove button on the left. You should be left with the Advisors, Data Entry (Experience Employees), Data Entry (Newer Employees), Reporting and System Administration groups, as shown in the image on the next page. Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 9 of 11

10 APPLYING ADVISOR SECURITY TO THE SECURITY SETS This section shows you how to apply security to each advisor. 1 In the Security Administration Console, click the plus to the left of the Database Security icon to expand the list of datasets. 2 Click the plus to the left of the Dataset name to expand the list of Security Sets. 3 Click the first security set in this example we are going to set security for Kate s Security Set first. 4 Click the permissions tab for the Security Set. You should see the groups with the globally assigned Security Profiles you set in the steps above. In this particular example, you should see: Advisors (Inherited) Data Entry (Experienced Employees) (Inherited) Data Entry (Newer Employees) (Inherited) Reporting (Inherited) System Administration (Inherited) 5 Under the left side of the window Users and Groups with Access click the Add button 6 From the list of users, select the name of the advisor you want to assign to this Security Set, and then click OK. In the example shown on the image to the right, we selected Kate Murphy. 7 With Kate Murphy selected on the left, click the Add button on the right, under the Profiles Assigned to Kate Murphy window. 8 From the dialog, select the appropriate security profile, and then click OK. In this example, we have selected the default Security Profile called Reporting (Security Set). Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 10 of 11

11 9 Click the Apply button under the window to save the changes to this Security Set. 10 Repeat steps 3 through 9 for each of the three advisor groups, ensuring you associate the correct Security Profile with the correct group. TEST SECURITY PROFILES After applying security, it is a best practice to verify or validate the assigned rights and permissions before users begin to login and change data. The fastest way to verify this information is the Effective Permissions tab. Since all users have permissions and rights granted at the database level, you only need to validate permissions on that level. In the example to the right, we are showing how to verify the permissions for Maria Brown. Online Use the Effective Permissions tab on the Database level to verify that specific users are added to the correct group, have the correct Security Profile applied and have the correct permissions and rights granted in the Security Profile. For more information about using the Effective Permissions tab, see Using the Effective Permissions Tab to Verify Permissions. For institutional audiences only Schwab Performance Technologies ( SPT ). All rights reserved PortfolioCenter is a product of Schwab Performance Technologies ( SPT ). SPT is a subsidiary of The Charles Schwab Corporation separate from its affiliate Charles Schwab & Co., Inc. ( CS&Co ). CS&Co is a registered broker-dealer and member SIPC that provides brokerage services, while SPT licenses software and provides related technology products and services. Individual names, account numbers and contact information listed in this document are fictional and not intended to reflect any existing individuals. Both real and fictional securities are listed in the document. Securities and strategies reflected in the document are for educational purposes only and are not, nor should they be construed as, recommendations to buy, sell, or continue to hold any investment nor do the accounts listed reflect individual securities accounts or holdings. Any similarity to an existing individual or account is purely coincidental. Screen shots are provided for illustrative purposes only and may be abridged. Security Configuration Example: Individual Advisors with Access Controlled by Roles and Tenure Page 11 of 11