Configuring access rights to application features. Role-based access control

Kaspersky Security Center Cloud Console provides facilities for role-based access to the features of Kaspersky Security Center Cloud Console and of managed Kaspersky applications.

You can configure access rights to application features for Kaspersky Security Center Cloud Console users in one of the following ways:

• By configuring the rights for each user or group of users individually.
• By creating standard user roles with a predefined set of rights and assigning those roles to users depending on their scope of duties.

Application of user roles is intended to simplify and shorten routine procedures of configuring users' access rights to application features. Access rights within a role are configured in accordance with the standard tasks and the users' scope of duties.

User roles can be assigned names that correspond to their respective purposes. You can create an unlimited number of roles in the application.

You can use the predefined user roles with already configured set of rights, or create new roles and configure the required rights yourself.

Access rights to application features

The table below shows the Kaspersky Security Center Cloud Console features with the access rights to manage the associated tasks, reports, settings, and perform the associated user actions.

To perform the user actions listed in the table, a user has to have the right specified next to the action.

Read, Write, and Execute rights are applicable to any task, report, or setting. In addition to these rights, a user has to have the Perform operations on device selections right to manage tasks, reports, or settings on device selections.

The General features: Access objects regardless of their ACLs functional area is intended for audit purposes. When users are granted Read rights in this functional area, they get full Read access to all objects and are able to execute any created tasks on selections of devices connected to the Administration Server via Network Agent with local administrator rights (root for Linux). We recommend granting these rights carefully and to a limited set of users who need them to perform their official duties.

All tasks, reports, settings, and installation packages that are missing in the table belong to the General features: Basic functionality functional area.

Access rights to application features

Predefined user roles

User roles assigned to Kaspersky Security Center Cloud Console users provide them with sets of access rights to application features.

Users created on a virtual Server cannot be assigned a role on the Administration Server.

You can use the predefined user roles with already configured set of rights, or create new roles and configure the required rights yourself. Some of the predefined user roles available in Kaspersky Security Center Cloud Console can be associated with specific job positions, for example, Auditor, Security Officer, Supervisor (these roles are present in Kaspersky Security Center Cloud Console starting from the version 11). Access rights of these roles are pre-configured in accordance with the standard tasks and scope of duties of the associated positions. The table below shows how roles can be associated with specific job positions.

Examples of roles for specific job positions

The table below shows the access rights assigned to each predefined user role.

Access rights of predefined user roles

Assigning access rights to specific objects

In addition to assigning access rights at the server level, you can configure access to specific objects, for example, to a specific task. The application allows you to specify access rights to the following object types:

• Administration groups
• Tasks
• Reports
• Device selections
• Event selections

To assign access rights to a specific object:

1. Depending on the object type, in the main menu, go to the corresponding section:
   • Assets (Devices) → Hierarchy of groups
   • Assets (Devices) → Tasks
   • Monitoring & reporting → Reports
   • Assets (Devices) → Device selections
   • Monitoring & reporting → Event selections
2. Open the properties of the object to which you want to configure access rights.

   To open the properties window of an administration group or a task, click the object name. Properties of other objects can be opened by using the button on the toolbar.

3. In the properties window, open the Access rights section.

   The user list opens. The listed users and security groups have access rights to the object. By default, if you use a hierarchy of administration groups or Servers, the list and access rights are inherited from the parent administration group or primary Server.

4. To be able to modify the list, enable the Use custom permissions option.
5. Configure access rights:
   • Use the Add and Delete buttons to modify the list.
   • Specify access rights for a user or security group. Do one of the following:
     • If you want to specify access rights manually, select the user or security group, click the Access rights button, and then specify the access rights.
     • If you want to assign a user role to the user or security group, select the user or security group, click the Roles button, and then select the role to assign.
6. Click the Save button.

The access rights to the object are configured.

Assigning access rights to users and security groups

You can give users and security groups access rights to use different features of Administration Server, for example, Kaspersky Endpoint Security for Linux.

To assign access rights to a user or a security group:

1. In the main menu, click the settings icon () next to the name of the required Administration Server.

   The Administration Server properties window opens.

2. On the Access rights tab, select the check box next to the name of the user or the security group to whom to assign rights, and then click the Access rights button.

   You cannot select multiple users or security groups at the same time. If you select more than one item, the Access rights button will be disabled.

3. Configure the set of rights for the user or group:
   1. Expand the node with features of Administration Server or other Kaspersky application.
   2. Select the Allow or Deny check box next to the feature or the access right that you want.

      Example 1: Select the Allow check box next to the Application integration node to grant all available access rights to the Application integration feature (Read, Write, and Execute) for a user or group.

      Example 2: Expand the Encryption key management node, and then select the Allow check box next to the Write permission to grant the Write access right to the Encryption key management feature for a user or group.

4. After you configure the set of access rights, click OK.

The set of rights for the user or group of users will be configured.

The permissions of the Administration Server (or the administration group) are divided into the following areas:

• General features:
  • Management of administration groups
  • Access objects regardless of their ACLs
  • Basic functionality
  • Deleted objects
  • Encryption Key Management
  • Event processing
  • Operations on Administration Server (only in the property window of Administration Server)
  • Device tags
  • Kaspersky application deployment
  • License key management
  • Application integration
  • Enforced report management
  • Hierarchy of Administration Servers
  • User permissions
  • Virtual Administration Servers
• Mobile Device Management:
  • General
  • Self Service Portal
• System Management:
  • Connectivity
  • Execute scripts remotely
  • Hardware inventory
  • Network Access Control
  • Operating system deployment
  • Vulnerability and patch management
  • Remote installation
  • Software inventory

If neither Allow nor Deny is selected for an access right, then the access right is considered undefined: it is denied until it is explicitly denied or allowed for the user.

The rights of a user are the sum of the following:

• User's own rights
• Rights of all the roles assigned to this user
• Rights of all the security group to which the user belongs
• Rights of all the roles assigned to the security groups to which the user belongs

If at least one of these sets of rights has Deny for a permission, then the user is denied this permission, even if other sets allow it or leave it undefined.

You can also add users and security groups to the scope of a user role to use different features of Administration Server. Settings associated with a user role will only apply only to devices that belong to users who have this role, and only if these devices belong to groups associated with this role, including child groups.