Overview

Security management is responsible for the system's security and controls access to modules and features. It also provides a set of business rules which can be used to automatically apply additional security controls.

Major features

• Control of actions, printouts, reports, WEB APIs, and modules accessible to groups of users through security profile
• Automatic assignment of privacy level to new records used to restrict access to groups of users
• Automatic assignment of tasks to users or groups of users
• Capturing of changes done to entries using audit trail
• Restriction of visibility and modification of fields to selected departments
• Custom selection of fields set as mandatory
• Creation of security keys which can be used in webhooks
  

Setting Up Security Management

Security Profiles

Security Profiles provide information related to the access of modules and features by users. For example, they determine whether a menu option is available on the left menu and if the 'New' button is available for subscriptions in the Data Entry page or if the accounts receivable report, and create WEB API will be available. 

Security profiles are then assigned to users and determine the respective modules and features each User will have access to when logging into the System. 

Security profile fields

The table describes the sections of Security Management Definitions Data Entry page, and explains how the fields in the page are used.

 Mandatory  

Privacy Levels and Privacy Level Groups

Privacy Level Groups are used to categorise the Privacy Levels.  Privacy levels are assigned to individual records of Explicit Viewing Entities (either manually by a dedicated action or automatically by PLARs) and are used to control the access to data when shared between organisational units as well as visibility and modification of information of those records.

Privacy levels have a flat structure and their hierarchy level is represented by a numeric value. Larger privacy level numbers denote higher privacy; Users that belong to organisational units that have access to records of a specific privacy level (e.g. Privacy Level 3)  can only access all records of that privacy level and below. (1,2,3).

Once privacy level groups and levels are configured, they must be used in collaboration with other system features to be used:

• Control over records shared between groups based on their privacy level: Create Group Collaboration Profiles and define the Privacy Levels and Privacy Level Groups as conditions of what is shared.
• Control over visibility and modification of records with a specific privacy level: Setup Conditional Security Restrictions and set visibility and modification restrictions on fields of records based on their privacy level. Refer to Applying conditional security conditions

Privacy level and privacy level group fields

The table describes the sections of Automatic Collaboration Rules Data Entry page, and explains how the fields in the page are used.

 Mandatory  

Privacy Level Assignment Rules (PLAR)

Privacy Level Assignment Rules (PLARs) are used to automatically apply privacy levels on entity records. PLARs are triggered when creating or modifying a record that meets the conditions set on the organisational units and the entity. PLARs are also applicable on all Web API calls.

Privacy level assignment rules fields 

The table describes the sections of Privacy Level Assignment Rules Data Entry page, and explains how the fields in the page are used.

 Mandatory   Configurable

Automatic Collaboration Rules (ACR)

Automatic Collaboration Rules (ACRs) are used to automatically assign a record to a specific user or unit based on a set of conditions, to further process the record up to its completion. ACRs are applied when creating or modifying a record that meets the ACR conditions. 

ACR is only applicable for the following Assignable entities:

• Activities
• Service requests
• Jobs
• Leads

Automatic collaboration rule fields

The table describes the sections of Automatic Collaboration Rules Data Entry page, and explains how the fields in the page are used.

 Mandatory   Configurable

Conditional Security Restrictions (CSR)

Conditional Security Restrictions (CSRs) are used to restrict the visibility of certain system features and attributes of each module, and to define particular attributes as 'Non-editable' or 'Mandatory'. The restrictions are applied provided that certain conditions set on the organisational units and the entity are met. CSRs are also applicable on all Web API calls. 

Different restrictions are applied for fields. processes and printouts

	Restrictions
Type	Visible Entity will be visible	Editable Entity will be available for editing	Mandatory Entity cannot be saved if not defined
Fields
Processes
Printouts

Conditional security restriction fields

The table describes the sections of Conditional Security Restrictions Data Entry page, and explains how the fields in the page are used.

 Mandatory  

Audit Trail

Audit Trail Settings define the rules governing Audit Trail logging in the System which monitors changes performed on System entries. Through Audit Trail Settings, the entities and fields that should be monitored can be selected. Only one 'Active' instance of Audit Trail Settings per Entity can be configured in the System. Audit Trail Settings can only be applied on predefined CRM.COM entities, either through the UI or Web API and during the execution on any of the following processes:

• Modifying
• Deleting
• Removing information 

The logging of an Audit Trail can be applied to a block of information or to components of that block. e.g., for the Contact Information Entity, the complete address block or only specific components of the address (e.g Address/District) can be monitored. When an address block is monitored, every time the address is modified, added or deleted, an entry will be added to the Audit Trail. When the district is monitored, an Audit Trail entry will be added when the district of an already defined address is updated.

Audit trail fields

The table describes the sections of Audit Trail Data Entry page, and explains how the fields in the page are used.

 Mandatory  

Secret Keys

Secret keys are registered to specific URL endpoints and are used by Webhooks in order generate a code that will be used by third-party systems to authenticate received data. 

Secret keys fields

The table describes the sections of Secret Keys Data Entry page, and explains how the fields in the page are used.

 Mandatory   Configurable

Related Configuration Areas

The following module is related to security management and must be configured for the security management module to operate at its full capacity.

Using Security Management

Assigning Privacy Level

Control who has access to records when shared between different departments, (collaboration of groups), or control visibility and modification of information of those records, by setting a privacy level. Use Actions > Set Privacy Level available from the Actions menu available through Summary and Data Entry Pages. 
In case you are setting the privacy level through the Summary page make sure that you first select all the records that you wish to update by checking  the checkbox on the left hand side of the record.

Additional Information

• By changing contact information or accounts receivable privacy levels, the privacy level of any Contact Information based Entities or Accounts Receivable based Entities records, is affected
• In case privacy level is not defined the record is accessible to all users.
• Privacy level can be automatically set on a record based on Privacy Level Assignment Rules (PLARs). 

Assigning security profile to users

Security Profiles are assigned to users through the Manage Users Data Entry page. Once you create the security profile you can define the security level of a user by adding the profile to his user. 

Viewing Audit Trail

Audit trail helps you identify and changes done to records in your system by providing information on the old and new value as well as the user that made the change. Once audit trailed entities are established, it will be possible to monitor their modifications directly from the entry's Data Entry page.

1. Navigate to the Data Entry page of a record with enabled audit trail
2. Click on the AUDIT LOG button located at the top-right corner of the page.
     
3. The Audit Log modal will open providing information on the modified fields and their changes. 

Applying conditional security restrictions

Conditional security restrictions are automatically applied as long as conditions set in the CSR are met. Below you can see a few examples of how you can use CSR.

• Fields: The address of a contact information with high privacy level is not visible to call centre agents

• Restricted Processes: Restrict the creation of a job of a 'New Subscription' fulfilment scope to call centre agents
• Restricted Printouts: Restrict the extraction of a wallet  printout when the wallet is cancelled

Applying automatic collaboration rules

Automatic collaboration rules are used to assign an activity a service request, a lead or a job to a specific user or unit with the purpose to handle them. For example, on creating a new lead for a potential rewards participant residing in London, you can automatically assign it to a marketing department call agent responsible for Londoners.

There are 2 ways that the assignment can be done.

Security Management Business Examples

Assign tasks for government representative customers to specific user

Hide sensitive information of government representative customers

Monitor change of addresses

Glossary