SecureAware User Management

Transcription

1 SecureAware User Management Applies to SecureAware version 4 Document date: November 2011 About this document This document describes user management in SecureAware.

2 Table of content Import AD users and groups... 3 Setting up the LDAP connection... 3 Connection... 3 Credentials... 4 Confirm... 4 Import users from the directory... 5 Create a new (internal) user... 5 Assigning access rights Create a Security Role... 6 Security roles in Risk TNG and User Management TNG... 6 Security Roles in other Modules Assign Security Roles (and target groups) to AD groups or users... 7 Assign Security Roles and target groups to AD groups... 7 Assign Security Roles and target groups to users individually Open the modules to the Security Role... 9 Access to User Menus... 9 Access to Management menus Login Login audit trail My SecureAware the start page The Start tab The Shortcuts tab The tab Tasks and Responsibilities The Teach Me! tab What should my users see when they log on? Functions List

3 Import AD users and groups Setting up the LDAP connection Go to Settings > Directories > New directory Connection Fill out the fields: Directory server URL Active directory domain name Short domain name The following fields are optional Mail Field Name Mail Template Click 3

4 Credentials You must now add an AD service user. This should be an administrative user whose password does not change. If you do NOT enter an AD service user, you can still validate users but you cannot use Single Sign-on (SSO) or import groups and organizational units Fill out the fields: AD service user AD service user password Test the connection before clicking Confirm Check and confirm your selections by clicking 4

5 Import users from the directory Go to Settings > Directories and click Refresh to the right of the domain. The users are now registered in SecureAware. This may take some time if the domain contains a large number of users, but you do not have to stay on the page while it refreshes. Create a new (internal) user Go to Settings > Directories > New User. Type the user s login, name and address (optional) and click Create. Select language, target group(s) and security role(s). Click Password and select a password for the user. 5

6 Assigning access rights In order to assign access rights you will have to: 1. create a security role 2. assign the security role to an AD group (or user) 3. Give the security role access to the relevant modules (not necessary for the modules Risk TNG and User Management TNG) 1. Create a Security Role You will find a list of security functions in the last section of this manual Security roles in Risk TNG and User Management TNG Go to Settings > Directories > Security Roles (you will find these under Assets, Risk and User Management) Click New Security Role Name and describe the security role (description is optional) Click Update Click the for each function you wish to add to the security role (hover over the name of the function to read the description). 6

7 Security Roles in other Modules Go to User Management > Manage Roles 1. Click Create a new security role if you do not find a suitable security role 2. Name and describe the security role (description is optional) 3. Click Create 4. Click Add and find the function you want to add 5. Click OK 6. Repeat step 4 and 5 as necessary 2. Assign Security Roles (and target groups) to AD groups or users Assign Security Roles and target groups to AD groups 1. Go to Settings > Groups 2. Find the group (there is a search field in the upper right corner) 3. Click Edit next to the group s name 4. Select one or more Security Roles in the Security Roles menu 5. Select one or more target groups in the Target Groups menu 6. Click Save 7

8 Assign Security Roles and target groups to users individually Go to Konfiguration > Brugere 1. Go to Settings > Users 2. Find the user (there is a search field in the upper right corner) 3. Click Edit next to the user s name 4. Select one or more Security Roles in the Security Roles menu 5. Select one or more target groups in the Target Groups menu 6. Click Save 8

9 3. Open the modules to the Security Role This step is not necessary for the modules Risk TNG and User Management TNG Go to User Management Access to User Menus The end-user menu is shown as a selection of tabs at the top of the screen. You can determine which roles are able to view the different end-user menu tabs by clicking on Menu Access roles. Select a role by clicking on Add next to the appropriate module name and select from the drop-down menu. Click to add. You can add as many roles as you like and delete them at any time by clicking on. 9

10 In addition to SecureAware s predefined roles and those created by a Super User, there are three standard roles for the end-user menu which can not be changed. These are: Anonymous users any user not logged on to SecureAware. (The standard program setting allows these users to view the Learn Security section only, but this can be extended.) Validated users all users who are logged on to SecureAware, either directly or through the AD. All users as the name suggests, all users whether logged on or not. Access to Management menus Access to the system management menu can be limited in the same was as for the end-user menu. The SecureAware management section is the section accessible using the module icons in the top righthand corner of the screen. Note: standard setup allows validated users access to My User Preferences and language selection only. The role of Super User can not be removed from the list of roles with access to the management section as this would cause a lock-out situation in which no one would have access to the SecureAware management functions. It is important to remember that even if a user has access to this section of SecureAware, in order to carry out tasks (for example, to run a compliance check), he or she must be granted specific access to the individual management function. 10

11 Login Password requirements AD user can log in to SecureAware with their Windows login. You can set the minimum requirements to internal users passwords by going to Settings > Passwords. Login audit trail All users login attempts are logged in an audit trail which is found in Settings > Audit Trail. If you want a detailed audit trail, check the Detailed log information on failed login and the Detailed log information on failed login menu. 11

12 My SecureAware the start page When you log on to SecureAware for the first time, you will most likely see the screen below. This is the start page, referred to as My SecureAware which, unless you change the settings (see the chapter What should my users see when they log on? ) will be the start page for all your users. My SecureAware consists of four different parts (tabs). The Start tab The first tab Start shows shortcuts to education content. As soon as you start creating a policy set, risk assessment, awareness quiz or compliance evaluations, the results/status of these will be shown here as in the screen below. 12

13 The bulletin board on the right hand side is where you can display messages to your users. To create a new message (or delete the default one), click on Messages. Now select either the message you would like to edit or Write message to create a new message on the bulletin board. When creating a new message, remember to select which target groups it should be shown to. After clicking Create you will see an icon in the bottom of the screen. Click on it to write a notification about this to your users. The Shortcuts tab The tab Shortcuts gives you as the name implies - a range of shortcuts to different functions in SecureAware. 13

14 The tab Tasks and Responsibilities The Tasks and Responsibilities tab gives you an overview of the tasks you have to carry out in SecureAware (left hand side). Click on the task to go directly to carrying it out. On the right hand side all your responsibilities are listed i.e. systems, assets or procedures. You can click on any of these (given you have the access rights necessary) to access it directly. The Teach Me! tab Under the Teach Me! Tab you and your users have easy access to education content of various forms. You have direct links to the rules and procedures of your policy set divided into topics of your choice. If you use the default SecureAware topics, your users will have access to education content and films covering these topics. 14

15 What should my users see when they log on? If you would rather have your users see another page when they access SecureAware, this is easily changed. Click on the Configuration icon in the top right corner of the screen and then click on Properties just below Start Page. Now click on the pencil and use the drop down box to select the start page of SecureAware. Remember to click OK before you click return. If you want to change the name of the tabs on My SecureAware, click on Properties under Manage My SecureAware Tabs. Now click on the pencil in front of the tab you want to change the name of, write the new name and click OK. 15

16 Your users will be able to select themselves which tab to see as changes. the first on My SecureAware. To do this, the user must click on the User Preferences icon in the top right corner, click on the pencil for My Start Tab, select the tab and click the arrow button to save the 16

17 Functions List Function Description Policy Policy Manager Superuser in the policy module Manage policy reports Can create reports in the policy module Generate pdf policy reports Can print pdf copies of the information security handbook Generate rtf policy reports Can print rtf copies of the information security handbook Awareness/education Only superusers can edit awareness and education content BCP The functions listed below are generel functions for the BCP module. If you want specific access rights on chapters of the business continuity plan, this should be assigned to the chapters individually. Please note: As of version all owners of (parts of) the business continuity plan are automatically assigned edit and delete rights. If an OU is linked to a part of the business continuity plan, this OU is automatically assigned read rights. Add Related Document Can add attachments to the business continuity plan Create Chapter Can create new chapters in the business continuity plan Create Plan Can create new business continuity plans Create Section Can create new sections in the business continuity plan Delete Chapter Can delete chapters in the business continuity plan Delete Section Can delete sections in the business continuity plan Edit Chapter Can edit chapters in the business continuity plan Edit Plan Can edit the business continuity plan Edit Section Can edit sections in the business continuity plan Manage Chapter Access Can assign access rights to the business continuity plan Manage Related Document Can edit attachments to the business continuity plan Compliance Analysis Create new Compliance check Can create a new compliance check Start Compliance check Can start a compliance check Stop Compliance check Can stop a compliance check 17

18 Reopen Compliance check Can reopen a compliance check View compliance check report Can read the compliance check report Delete Compliance check Can delete a compliance check Perform a compliance check Can answer a compliance check (only the sections assigned to the user, though) Document Management Document file delete Can delete documents Document file edit Can edit documents Document file security Can set document access rights Document file upload Can upload documents Document folder create Can create folders Document folder delete Can delete folders Document folder edit Can edit folders Document folder security Can set folder access rights Change Document file security Can edit document access rights Change Document folder security Can edit folder access rights Risk TNG Users will automatically receive access rights to carry out the assessments they are assigned Risk Administrator Superuser in Risk TNG Asset Manager Provides access to view, create, edit, and delete any asset Create new assets Provides access to create new assets as well as to view and edit assets if the user is the asset owner or administrator Delete assets Provides access to delete any asset Delete my assets Provides access to delete an asset if the user is the asset owner or administrator Edit assets Provides access to edit information on any asset Edit my assets Provides access to edit asset information if the user is the asset owner or administrator Asset Administrator Provides access to all functionality regarding asset administration including administration of asset security roles View assets Provides access to view all assets and related information 18

19 View my assets Risk Assessment Risk History Delete All Assessments Risk History Delete My Assessments Risk History - View All Assessments Risk History - View My Assessments Risk Treatment User (from version 4.1.5) Risk Treatment Manager (from version 4.1.5) Risk 1 (ældre riskmodul) Asset Management Create new risk assessment Delete risk assessment Perform risk business impact assessment Perform risk import and exports Perform risk question management Perform risk severity scale management Perform risk vulnerability assessment Process Management Reopen a risk assessment Start a risk assessment Stop a risk assessment System Management View risk assessment report Compliance Workflow Create new task Provides access to view an asset its related information if the user is the asset owner or administrator Provides access to perform a risk assessment of an asset. Please note that users who are assigned an assessment task are automatically assigned this access right Provides access to delete any assessment Provides access to delete own assessments Provides access to view the history of all assessments Provides access to view the history of own assessments Provides access to carry out risk treatment tasks Provides access to delegate risk treatment tasks Can create, edit and delete assets Can create new risk assessments Can delete risk assessments Can perform business impact assessment Can importy and export content from the risk module Can create, edit and delete assessment questions Can create, edit and delete severity scales Can perform vulnerability assessment Can create, edit and delete processes Can reopen a risk assessment Can start a risk assessment Can stop a risk assessment Can create, edit and delete systems Can print risk assessment reports Can create and assign new tasks 19

20 Delete a task Edit a task Generate task reports Manage task reports Manage task settings Settings Content Category Management Report General Configuration SecureAware 2 Import Standard Management Target Group Management User Management TNG TNG OU-administrator TNG Brugeradministrator TNG Brugerbiblioteksadministrator TNG Gruppeadministrator TNG Sikkerhedsrolleadministrator TNG Brugeradministrator Obsolete functions Create asset Create new Policy Delete asset Delete asset level Edit Asset level Edit asset Manage Asset Read Asset level Read asset Can delete tasks Can edit tasks Can print task reports Can create, edit and delete task reports Can manage task settings Can create, edit and delete content categories (topics) Can manage report configuration (page layout etc) Can import SecureAware version 2 content Can create, edit and delete standards in the standard manager Can create, edit and delete target groups Can manage OU s Can manage users Can manage directories Can manage AD groups Can manage security roles User Management superuser 20

21 Contact Information - Further information is available by contacting Neupart Denmark Neupart A/S Hollandsvej Lyngby Denmark Tel Fax Germany Kaiserwerther Strasse Ratingen/Düsseldorf Germany: Tel. +49 (0) 2102/ Fax +49 (0) 2102/42062 Copyright 2006 Neupart A/S. All rights reserved. The author of this documentation is Neupart A/S. All information herein including text and graphics belongs to Neupart A/S unless stated otherwise and is protected by copyright laws in Denmark and international agreements. Permission to quote this documentation in its entire form or partly is given under the premises that no changes are made and that information about this copyright is clearly stated on all copies. No material may be copied or distributed without explicit approval of Neupart A/S. Neupart A/S preserves the right to - at any time and without warning make changes and/or improvements in the products mentioned. Names of other companies and their products are or can be registered trademarks or trademarks that belong to their owners. Neupart and SecureAware logo and the name SecureAware are trademarks belonging to Neupart A/S. The documentation is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and non-infringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the documentation or the use or other dealings in the documentation. The documentation including graphics could contain inaccuracies or typographic errors. Furthermore there are no guarantees regarding results achieved by using this information. All rights not explicitly mentioned herein are preserved. 21