Configuring access rights to application features. Role-based access control

Kaspersky Security Center provides facilities for role-based access to the features of Kaspersky Security Center and managed Kaspersky applications.

You can configure access rights to application features for Kaspersky Security Center users in one of the following ways:

• By configuring the rights for each user or group of users individually.
• By creating standard user roles with a predefined set of rights and assigning those roles to users depending on their scope of duties.

User role (also referred to as a role) is a predefined set of access rights to the features of Kaspersky Security Center or managed Kaspersky applications. A role can be assigned to a user or a group of users.

Application of user roles is intended to simplify and shorten routine procedures of configuring users' access rights to application features. Access rights within a role are configured in accordance with the standard tasks and the users' scope of duties.

User roles can be assigned names that correspond to their respective purposes. You can create an unlimited number of roles in the application.

You can use the predefined user roles with already configured set of rights, or create new roles and configure the required rights yourself.

Access rights to application features

The table below shows the Kaspersky Security Center features with the access rights to manage the associated tasks, reports, settings, and perform the associated user actions.

To perform the user actions listed in the table, a user has to have the right specified next to the action.

Read, Modify, and Execute rights are applicable to any task, report, or setting. In addition to these rights, a user has to have the Perform operations on device selections right to manage tasks, reports, or settings on device selections.

All tasks, reports, settings, and installation packages that are missing in the table belong to the General features: Basic functionality functional area.

Access rights to application features

Page top

Predefined user roles

User roles assigned to Kaspersky Security Center users provide them with sets of access rights to application features.

You can use the predefined user roles with already configured set of rights, or create new roles and configure the required rights yourself. Some of the predefined user roles available in Kaspersky Security Center can be associated with specific job positions, for example, Auditor, Security Officer, Supervisor (these roles are present in Kaspersky Security Center starting from the version 11). Access rights of these roles are pre-configured in accordance with the standard tasks and scope of duties of the associated positions. The table below shows how roles can be associated with specific job positions.

Examples of roles for specific job positions

The table below shows the access rights assigned to each predefined user role.

Access rights of predefined user roles

Page top

Adding a user role

To add a user role:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the context menu of the Administration Server, select Properties.
3. In the Administration Server properties window, in the Sections pane select User roles and click the Add button.

   The User roles section is available if the Display security settings sections option is enabled.

4. In the New role properties window, configure the role:
   • In the Sections, select General and specify the name of the role.

     The name of a role cannot be more than 100 characters long.

   • Select the Rights section, and configure the set of rights by selecting the Allow and Deny check boxes next to the application features.

   If you are operating on the primary Administration Server, you can enable the Relay list of roles to secondary Administration Servers option.

5. Click OK.

The role is added.

User roles that have been created for Administration Server are displayed in the Administration Server properties window, in the User roles section. You can modify and delete user roles, as well as assign roles to user groups or selected users.

Page top

Assigning a role to a user or a user group

To assign a role to a user or a group of users:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the context menu of the Administration Server, select Properties.
3. In the Administration Server properties window, select the Security section.

   The Security section is available if the Display security settings sections check box is selected in the interface settings window.

4. In the Names of groups or users field, select a user or a group of users to which you want to assign a role.

   If the user or the group is not contained in the field, you can add it by clicking the Add button.

   When you add a user by clicking the Add button, you can select the type of user authentication (Microsoft Windows or Kaspersky Security Center). Kaspersky Security Center authentication is used for selecting the accounts of internal users that are used for working with virtual Administration Servers.

5. Select the Roles tab and click the Add button.

   The User roles window opens. This window displays user roles that have been created.

6. In the User roles window, select a role for the user group.
7. Click OK.

The role with a set of rights for working with Administration Server is assigned to the user or the user group. Roles that have been assigned are displayed on the Roles tab in the Security section of the Administration Server properties window.

Page top

Assigning permissions to users and groups

You can give users and groups permissions to use different features of Administration Server and of the Kaspersky programs for which you have management plug-ins, for example, Kaspersky Endpoint Security for Windows.

To assign permissions to a user or a group of users:

1. In the console tree, do one of the following:
   • Expand the Administration Server node and select the subfolder with the name of the required Administration Server.
   • Select the administration group.
2. In the context menu of the Administration Server or the administration group, select Properties.
3. In the Administration Server properties window (or the administration group properties window) that opens, in the left Sections pane select Security.

   The Security section is available if the Display security settings sections check box is selected in the interface settings window.

4. In the Security section, in the Names of groups or users list select a user or a group.
5. In the permissions list in the lower part of the workspace, on the Rights tab configure the set of rights for the user or group:
   1. Click the plus signs (+) to expand the nodes in the list and gain access to the permissions.
   2. Select the Allow and Deny check boxes next to the permissions that you want.

      Example 1: Expand the Access objects regardless of their ACLs node or Deleted objects node, and select Read.

      Example 2: Expand the Basic functionality node, and select Write.

6. When you have configured the set of rights, click Apply.

The set of rights for the user or group of users will be configured.

The permissions of the Administration Server (or the administration group) are divided into the following areas:

• General features:
  • Management of administration groups (only for Kaspersky Security Center 11 or later)
  • Access objects regardless of their ACLs (only for Kaspersky Security Center 11 or later)
  • Basic functionality
  • Deleted objects (only for Kaspersky Security Center 11 or later)
  • Event processing
  • Operations on Administration Server (only in the property window of Administration Server)
  • Deploy Kaspersky applications
  • License key management
  • Enforced report management (only for Kaspersky Security Center 11 or later)
  • Hierarchy of Servers
  • User rights
  • Virtual Administration Servers
• Mobile Device Management:
  • General
• System Management:
  • Connectivity
  • Hardware inventory
  • Network Access Control
  • Deploy operating system
  • Manage vulnerabilities and patches
  • Remote installation
  • Software inventory

If neither Allow nor Deny is selected for a permission, then the permission is considered undefined: it is denied until it is explicitly denied or allowed for the user.

The rights of a user are the sum of the following:

• User's own rights
• Rights of all the roles assigned to this user
• Rights of all the security group to which the user belongs
• Rights of all the roles assigned to the security groups to which the user belongs

If at least one of these sets of rights has Deny for a permission, then the user is denied this permission, even if other sets allow it or leave it undefined.

Page top

Propagating user roles to secondary Administration Servers

By default, the lists of user roles of the primary and secondary Administration Servers are independent. You can configure the application to automatically propagate the user roles created on the primary Administration Server to all of the secondary Administration Servers. The user roles can also be propagated from a secondary Administration Server to its own secondary Administration Servers.

To propagate user roles from the primary Administration Server to the secondary Administration Servers:

1. Open the main application window.
2. Do one of the following:
   • In the console tree, right-click the name of the Administration Server and select Properties in the context menu.
   • If you have an active Administration Server policy, in the workspace of the Policies folder, right-click this policy and select Properties in the context menu.
3. In the Administration Server properties window, or in the policy settings window, in the Sections pane select User roles.

   The User roles section is available if the Display security settings sections option is enabled.

4. Enable the Relay list of roles to secondary Administration Servers option.
5. Click OK.

The application copies the user roles of the primary Administration Server to the secondary Administration Servers.

When the Relay list of roles to secondary Administration Servers option is enabled and the user roles are propagated, they cannot be edited or deleted on the secondary Administration Servers. When you create a new role or edit an existing one on the primary Administration Server, the changes are automatically copied to the secondary Administration Servers. When you delete a user role on the primary Administration Server, this role remains on the secondary Administration Servers afterward, but it can be edited or deleted.

The roles that are propagated to the secondary Administration Server from the primary Server are displayed with the lock icon (). You cannot edit these roles on the secondary Administration Server.

If you create a role on the primary Administration Server, and there is a role with the same name on its secondary Administration Server, the new role is copied to the secondary Administration Server with the index added to its name, for example, ~~1, ~~2 (the index can be random).

If you disable the Relay list of roles to secondary Administration Servers option, all the user roles remain on the secondary Administration Servers, but they become independent from those on the primary Administration Server. After becoming independent, the user roles on the secondary Administration Servers can be edited or deleted.