Highly Granular Access Control Model
Optial has a highly granular access control model, which ensures that each user gets access to risk and loss information on a need-to-know basis. Access is primarily driven by the roles a user plays, in each relevant organisation unit; double hatting is also supported. The multi-level security and permissions infrastructure underpins all data and functional access within the system. Features include:
- Ability to either grant or deny privileges
- Ability to differentiate between privileges including read, update, add, delete and workflow functions
- Ability to segregate entire object classes, e.g. so user administrators do not see business data
- Configurable fine-tuning of specific menu items, workflow options or individual pages; down to field level.
- Ability to track read access in the audit trail
- ‘Four-Eyes’ concept, used when highly secure approvals are required, enforces that at least two individuals sign off on a new or changed item before it is activated.
Access Control of data displayed in the integrated Optial reporting module - Optial Business Intelligence (OBI) - is also tightly controlled using the powerful base Optial security model to provide the same level and granularity of security of data for secure end user reporting and the powerful slice and dice analysis feature; this is rarely available in other systems where data is generally exported from the main system into a 3rd party application or Excel spreadsheet at which point all security of the data is lost.
Tamper-Proof Audit Trail
In addition, Optial has a tamper-proof audit trail kept for every change to a business data object (including users themselves); so that you can effectively roll back time to see your entire process status as at any previous point in time. The audit trail includes the user ID of the person creating the change, the date/time stamp of the change, and an entire copy of the whole record at every point in time. All of these previous versions can be accessed on line,even when an item is deleted.
User Authentication
Users can be identified using 2 main methods in Optial – either Forms based logon or integrated authentication mode.
Forms Mode:
This authenticates using Forms based logon, using user and password. The passwords are stored using industry standard encryption methods. Also there are configurable rules such as minimum length for passwords, password complexity rules, disallowed password dictionary lookup, forced change of passwords initially and on a regular basis, number of allowed attempts, automatic disabling of unused accounts, password history, permanent or temporary locking, and dual administrator control for adding or changing users according to the four-eyes principle. Additionally system administration reporting includes User Logins, Dormant Users, Sign-on Violations, User Listings, Resource Violations and User Administration Activity. These reports are available indefinitely, so it is always possible to go back in time to review information from a particular day or over a period of time.
Integrated Authentication:
In this case the users are authenticated via IIS, and on successful authentication the Optial application is given the active user name. This offers a seamless Single Sign On (SSO) with the corporate environment. This is then used to match up with an internal list of users that can be synchronised.