Access control methods are determined by security policy. The security policy contains parameters that have global effect on the system security level. A security level for a specific object can be determined by changing access control and criticality labels.
Permission and privilege owners are security subjects — users and user groups.
The security manager supports complementary access control methods:
Control over user actions in the system means checking if the user has a privilege necessary to execute these operations. Control of users accessing objects and executing various operations with them is executed by checking if there are necessary permissions to execute specific operations with objects.
The discretionary access control method grants permissions on DBMS level. The mandatory access control method, level-based access control method and attribute-based access control method grant permissions on platform level. The attribute-based access control method is a data filtering when the user accesses data via rules and policies check.
To get detailed information about access control methods, see the Setting Up Discretionary Access Control Method, Setting Up Mandatory Access Control Method, Setting Up Level-Based Access Control Method, Setting Up Attribute-Based Access Control Method sections.
If required, use role separation between the information security administrator (ISA) and the application administrator (AA). By default, role separation is not used, and all functions are executed by the system administrator.
To set up general security policy, see the General Policy Settings article.
To set up user password check, see the Setting Up User Password Check article.
To set up advanced access control, see the Advanced Access Control Settings article.
To manage access control methods, use the Access Control tab in the Policies Editor section of the navigation panel.
NOTE. When roles of the information security administrator and the application administrator are separated, the Policies Editor section is available only for the information security administrator.
The Access Control tab:
Select access control methods:
To use discretionary access control method, select the Use Discretionary Access Control checkbox.
To use mandatory access control method, select the Use Mandatory Access Control checkbox.
To use level-based access control method, select the Use Security Levels checkbox.
To use attribute-based access control method, select the Use Attribute-Based Access Control checkbox. When attribute-based and discretionary access control methods are used at the same time, select the permission combination algorithm:
AND. The operation is allowed if the operation is allowed simultaneously for two access control methods. If the operation is denied for one of access control methods or access permissions are undefined, the operation is denied.
OR. The operation is allowed if operation permission is set up for at least one of access control methods, and access permissions are undefined for the other access control method. If the operation is denied for one of access control methods, the operation is denied.
NOTE. The discretionary access control is set in the access control by default.
To apply the specified settings, click the Save button on the toolbar or side panel.
NOTE. If section parameters have been changed, an attempt to go to another section of the security manager or to close it displays a request to apply changed settings.
See also:
Setting Up System Security Policy | Creating User Accounts and Working with Them | Creating User Groups and Working with Them