WEBVTT 1 00:00:00.601 --> 00:00:11.817 Welcome to NxSAM training. This module covers User Access: accounts, roles, permissions, groups, and the rules that decide who can do what. 2 00:00:12.114 --> 00:00:27.750 It is worth doing properly once. Access control is the part of a platform people configure quickly at the start and then live with for years - and the mistakes are quiet ones, because nobody reports being able to see too much. 3 00:00:28.356 --> 00:00:45.407 There are four separate things here, and they are genuinely separate rather than four names for the same idea. Who somebody is. What they are allowed to do. Which organisation they belong to. And where they may connect from. 4 00:00:46.033 --> 00:00:48.953 Start with the accounts themselves. 5 00:00:49.537 --> 00:01:02.987 The list carries user details, the roles they hold, their username, whether they are an organisation user or an auditor, their I P group, who created them, their last sign-in, and their status. 6 00:01:03.591 --> 00:01:10.464 Two of those columns do more work than the rest, and both are about accounts nobody is thinking about. 7 00:01:11.049 --> 00:01:28.531 Last sign-in is your dormant-account report, and you already have it. An account that has not been used in six months is either somebody who left, or a service account nobody documented. Both are worth resolving before an auditor asks. 8 00:01:29.152 --> 00:01:47.215 Status separates a disabled account from a deleted one, and the difference matters. Disabling keeps the history - every finding they raised, every approval they gave, still attributed to a real person. Deleting is how a trail becomes anonymous. 9 00:01:47.818 --> 00:01:56.758 So the habit when somebody leaves is to disable rather than remove. It costs nothing and it keeps your audit trail answerable. 10 00:01:57.350 --> 00:02:17.498 The organisation-user and auditor distinction is the other one to understand. An auditor is somebody doing assessment work - often external - rather than somebody who belongs to the organisation being assessed. They are told apart here because much of the product's workflow depends on which they are. 11 00:02:18.086 --> 00:02:25.750 The controls above the list are for doing this at scale, which is where access administration actually happens. 12 00:02:26.337 --> 00:02:40.531 Add Users creates one. Doing it at scale means a spreadsheet instead - a reorganisation, a role change across a team, a joiner batch - and the queue behind those uploads is the next screen. 13 00:02:41.126 --> 00:02:57.915 There are two exports and they answer different questions. Export All Users is the account list. Download all users with assets is the one to reach for at review time, because it says who can see what rather than merely who exists. 14 00:02:58.493 --> 00:03:07.432 That second one is the access review most organisations owe somebody annually, and producing it by hand from this screen would take a day. 15 00:03:08.012 --> 00:03:12.870 And the Bulk Update Logs screen is the queue behind those changes. 16 00:03:13.442 --> 00:03:22.093 One row per run: its status, a summary of what it did, who initiated it, when, and a log file to download. 17 00:03:22.717 --> 00:03:39.741 Read the summary rather than the status. A bulk update that succeeded and a bulk update that quietly skipped nine rows out of two hundred both report as finished - the summary is where the difference is stated, and the log file is where each skipped row is named. 18 00:03:40.350 --> 00:03:52.840 That is the same pattern as the upload queues elsewhere in the product, and for the same reason: a change to access control is exactly the kind of thing you want to be able to prove afterwards. 19 00:03:53.463 --> 00:03:57.550 Now what an account is allowed to do, which is a role. 20 00:03:58.158 --> 00:04:09.975 The list is short - a role name and who created it - because a role's substance is not on this screen. It is the set of permissions inside it, and that is worth opening. 21 00:04:10.565 --> 00:04:12.518 Let us build one. 22 00:04:13.117 --> 00:04:25.897 A name, and then a two-pane picker. The left is every part of the product, grouped into modules. The right is the individual permissions inside whichever module you have selected. 23 00:04:26.511 --> 00:04:43.420 Each module carries a counter - how many of its permissions this role holds. A new role opens at zero, and that counter is the useful part, because it lets you read a role back by scanning down the left rather than opening every module in turn. 24 00:04:44.007 --> 00:05:00.337 And the permissions themselves are specific rather than broad. Not "manage applications" but List, Add, Update, Delete, Update Audit Status, Update Report Status, and the individual exports, each on its own. 25 00:05:00.921 --> 00:05:16.027 That granularity is the point of the whole screen, and it is what makes least privilege achievable rather than aspirational. Somebody who needs to read findings and export them does not need to be able to change their status. 26 00:05:16.608 --> 00:05:30.874 The search box matters more than it looks, because the catalogue is large - over a hundred modules in a full deployment. Search for the word in the action you have in mind, rather than hunting for the module it lives in. 27 00:05:31.473 --> 00:05:47.066 Select All is there, and it is worth being deliberate about. A role with everything selected is an administrator, whatever it is called - and roles named for a job rather than for their power are how over-entitlement becomes invisible. 28 00:05:47.645 --> 00:06:01.479 There is also a system-role flag, set here, and shown as a lock beside the role in the list. It distinguishes the roles the platform itself relies on from the ones you create for your own organisation. 29 00:06:02.041 --> 00:06:07.479 A word on designing roles, because this is where most deployments go wrong. 30 00:06:07.745 --> 00:06:21.867 The temptation is to create a role per person. It works for a month and then you have forty roles, no two alike, and no way to answer what a security analyst can do because there are nine of them and they differ. 31 00:06:22.447 --> 00:06:37.171 Design instead for jobs. A handful of roles that describe what somebody does - reads findings, fixes findings, runs assessments, administers the platform - and everybody gets the one that matches. 32 00:06:37.760 --> 00:06:52.364 When somebody genuinely needs something extra, the right move is usually a second role rather than a variant of the first. Roles combine, and two clean roles are far easier to review than one bespoke one. 33 00:06:52.963 --> 00:07:05.717 And review them on a schedule. Permissions get added to roles and almost never removed, so a role that was carefully scoped two years ago is usually broader now than anybody intends. 34 00:07:06.314 --> 00:07:09.806 User groups are a different axis again. 35 00:07:10.403 --> 00:07:18.549 The list gives the group's name, the organisation it belongs to, how many users are in it, and who created it. 36 00:07:19.134 --> 00:07:30.132 A group is a named set of people within one organisation, and that user count is a live figure rather than something typed in - so an empty group is visibly empty. 37 00:07:30.720 --> 00:07:47.290 Which is worth checking, because a group that has quietly emptied is how a notification stops reaching anybody without any error being raised. The same failure shape as everywhere else in this product: nothing arrives, and nothing says so. 38 00:07:47.906 --> 00:07:53.125 Then the control most people misread, and it is worth being precise about. 39 00:07:53.728 --> 00:08:07.829 An I P group is not a set of hosts a user is allowed to look at. It is a list of network addresses a user is allowed to connect *from* - a sign-in restriction, not a data scope. 40 00:08:08.408 --> 00:08:25.817 The list carries the group's number, its name, a free-text note, and who created it. The addresses themselves are one level down, each with a remark - and use that remark, because an address with no explanation is impossible to retire safely. 41 00:08:26.437 --> 00:08:39.647 Assign a group to a user, and every request they make is checked against it. Which makes the next part important, because the way an address is matched is not what most people assume. 42 00:08:40.269 --> 00:08:51.632 There is no subnet mask on this screen, and no slash notation. Ranges are expressed a different way, and it is the single thing to remember about this feature. 43 00:08:52.228 --> 00:09:06.446 An address is compared one part at a time - the four numbers separated by dots. And a zero in any of those four positions means *anything* in that position, rather than the number zero. 44 00:09:07.046 --> 00:09:24.771 So ten, forty-two, zero, zero means any address beginning ten, forty-two. Ten, zero, zero, zero means anything in the ten range. That is how you whitelist an office network without listing every machine in it. 45 00:09:25.361 --> 00:09:29.525 Two consequences follow, and both catch people out. 46 00:09:30.121 --> 00:09:43.954 Ranges have to fall on those four boundaries. You can allow a whole part or a single address, and there is nothing in between - so a range covering half of one part has to be written as several entries. 47 00:09:44.543 --> 00:09:58.569 And you cannot whitelist an address that genuinely ends in zero, because that is read as the wildcard. It is rarely a problem in practice, but it is the kind of thing worth knowing before it becomes a puzzle. 48 00:09:59.161 --> 00:10:10.836 The wildcard is positional rather than trailing, incidentally. A zero in the second position means anything there, with the parts after it still matched exactly. 49 00:10:11.406 --> 00:10:17.487 Two more facts about how this is enforced, both of which change how you should use it. 50 00:10:17.780 --> 00:10:35.168 When a check fails, the user is signed out rather than shown a permission message. So a colleague reporting that the platform keeps logging them out, and who has recently moved desk or started working from home, is describing this feature rather than a fault. 51 00:10:35.792 --> 00:10:43.410 That is worth putting in your own onboarding notes, because it does not look like an access rule from the outside. 52 00:10:44.016 --> 00:10:54.538 And the check covers the older, four-part addresses only. A connection arriving over the newer addressing scheme is not checked against the group at all. 53 00:10:55.138 --> 00:11:08.999 So treat this as a useful additional control rather than a boundary you rely on. If the restriction genuinely has to hold, enforce it at the network - and use this to catch the ordinary cases. 54 00:11:09.570 --> 00:11:15.025 Two smaller screens remain, and the first is easy to misread from its name. 55 00:11:15.615 --> 00:11:28.129 A user level is not a rank, and it grants nothing. It is a set of three names - level one, level two, level three - for the three tiers your estate is organised into. 56 00:11:28.732 --> 00:11:45.253 The platform's own defaults are organisation, business unit and project. But one client says company, division and application; another says group, entity and system. This is where you say which words yours uses. 57 00:11:45.869 --> 00:12:00.519 Those names then appear in emails and reports, so a scheduled report reads in your organisation's vocabulary rather than the product's. Where a user has no level set, the third tier is simply called Project. 58 00:12:01.105 --> 00:12:12.992 The three names must differ from one another - the platform refuses a set where two are the same, which is right, because two tiers with the same name would make every report ambiguous. 59 00:12:13.568 --> 00:12:17.322 And super administrators are held separately. 60 00:12:17.936 --> 00:12:32.462 A short list - the user, and who granted it. Short is the point: this is the account that can change access control itself, so the list existing as its own screen makes it reviewable at a glance. 61 00:12:33.078 --> 00:12:44.652 Keep it to the smallest number of people who genuinely need it, name a second so you are never locked out by one person's absence, and check this screen whenever you check anything else here. 62 00:12:45.258 --> 00:13:06.820 That is User Access. Accounts with a status and a last sign-in. Roles built from individual permissions. Groups of people. I P groups that decide where somebody may connect from. Levels that name your tiers. And a short list of super administrators. 63 00:13:07.087 --> 00:13:24.120 Three habits. Design roles for jobs rather than for people. Disable rather than delete, so the trail survives. And remember that a zero in an address means anything, which is the one rule on these screens nobody guesses. 64 00:13:24.726 --> 00:13:35.991 And once a year, download the users-with-assets export and read it. It is the only view that answers what your people can actually see, and it takes one click.