215 lines
11 KiB
HTML
215 lines
11 KiB
HTML
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
|
<!DOCTYPE html
|
||
|
|
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||
|
|
<html lang="en-us" xml:lang="en-us">
|
||
|
|
<head>
|
||
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||
|
|
<meta name="security" content="public" />
|
||
|
|
<meta name="Robots" content="index,follow" />
|
||
|
|
<meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' />
|
||
|
|
<meta name="DC.Type" content="concept" />
|
||
|
|
<meta name="DC.Title" content="Plan user groups" />
|
||
|
|
<meta name="abstract" content="This topic describes what to do to prepare for planning user groups." />
|
||
|
|
<meta name="description" content="This topic describes what to do to prepare for planning user groups." />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzamvplanusersec.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzamvplangrpprof.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzamvusergrpidworksheet.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzamvusergrpdescworksheet.htm" />
|
||
|
|
<meta name="copyright" content="(C) Copyright IBM Corporation 2006" />
|
||
|
|
<meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 2006" />
|
||
|
|
<meta name="DC.Format" content="XHTML" />
|
||
|
|
<meta name="DC.Identifier" content="planusergrp" />
|
||
|
|
<meta name="DC.Language" content="en-us" />
|
||
|
|
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
||
|
|
<!-- US Government Users Restricted Rights -->
|
||
|
|
<!-- Use, duplication or disclosure restricted by -->
|
||
|
|
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
||
|
|
<link rel="stylesheet" type="text/css" href="./ibmdita.css" />
|
||
|
|
<link rel="stylesheet" type="text/css" href="./ic.css" />
|
||
|
|
<title>Plan user groups</title>
|
||
|
|
</head>
|
||
|
|
<body id="planusergrp"><a name="planusergrp"><!-- --></a>
|
||
|
|
<!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script>
|
||
|
|
<h1 class="topictitle1">Plan user groups</h1>
|
||
|
|
<div><p>This topic describes what to do to prepare for planning user groups.</p>
|
||
|
|
<p>The first step in the planning process, deciding your security strategy,
|
||
|
|
is like setting company policy. Now you are ready to plan for groups of users,
|
||
|
|
which is like deciding department policy.</p>
|
||
|
|
<p><span class="uicontrol">What is a user group?</span> A user group is exactly what
|
||
|
|
its name implies: a group of people who need to use the same applications
|
||
|
|
in the same way. Typically, a user group consists of people who work in the
|
||
|
|
same department and have similar job responsibilities. You define a user group
|
||
|
|
by creating a group profile.</p>
|
||
|
|
<div class="p"><span class="uicontrol">What does a group profile do?</span> A group profile serves
|
||
|
|
two purposes on the system: <ul><li><span class="uicontrol">Security tool:</span> A group profile provides a simple
|
||
|
|
way to organize who can use certain objects on your system (object authorities).
|
||
|
|
You can define object authorities for an entire group rather than for each
|
||
|
|
individual member of the group.</li>
|
||
|
|
<li><span class="uicontrol">Customizing tool:</span> You can use a group profile as
|
||
|
|
a pattern for creating individual user profiles. Most people who are part
|
||
|
|
of the same group have the same customizing needs, such as the initial menu
|
||
|
|
and the default printer. You can define these in the group profile and copy
|
||
|
|
them to the individual user profiles.</li>
|
||
|
|
</ul>
|
||
|
|
Group profiles make it easier for you to maintain a simple, consistent
|
||
|
|
scheme for both security and customizing.</div>
|
||
|
|
<div class="section"><h4 class="sectiontitle">What forms do you need?</h4><ul><li>Complete a user group ID worksheet to identify the groups of users on
|
||
|
|
your system that have similar application needs.</li>
|
||
|
|
<li>Complete a user group description for each group that uses
|
||
|
|
your system.</li>
|
||
|
|
</ul>
|
||
|
|
To complete these forms, you will need to perform the following tasks: <ol><li>Identify user groups</li>
|
||
|
|
<li>Plan group profiles</li>
|
||
|
|
<li>Choose values that affect sign on</li>
|
||
|
|
<li>Choose values that limit what a user can do</li>
|
||
|
|
<li>Choose values that set up the user's environment</li>
|
||
|
|
</ol>
|
||
|
|
</div>
|
||
|
|
<div class="section"><h4 class="sectiontitle">Identifying user groups</h4><div class="p">When you plan your user
|
||
|
|
groups, you must first identify groups of users on your system. This allows
|
||
|
|
you to plan accesses to resources that these groups need. Try using a simple
|
||
|
|
method to identify your user groups. Think about the departments or work groups
|
||
|
|
who plan to use the system. Look at the application diagram you drew earlier
|
||
|
|
of your applications. See if a natural relationship exists between work groups
|
||
|
|
and applications: <ul><li>Can you identify a primary application for each work group?</li>
|
||
|
|
<li>Do you know which applications each group needs? Which applications they
|
||
|
|
do not need?</li>
|
||
|
|
<li>Do you know which group should own the information in each application
|
||
|
|
library?</li>
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
<p>If you can answer ″Yes″ to those questions, then you can begin
|
||
|
|
to plan your user groups. However, if you answered ″sometimes″ or ″maybe″,
|
||
|
|
then you might find it helpful to use a systematic approach to identify your
|
||
|
|
user groups.</p>
|
||
|
|
<div class="note"><span class="notetitle">Note:</span> Making users a member of only one group profile simplifies
|
||
|
|
your security management. However, some situations can benefit from having
|
||
|
|
users belong to more than one group profile. Having users belong to more than
|
||
|
|
one group profile is usually easier to manage than giving many private authorities
|
||
|
|
to individual user profiles.</div>
|
||
|
|
<p>Decide what your user groups should
|
||
|
|
be. Fill in the User Group Identification form, if you need it to help you
|
||
|
|
decide. After you add your users to the User Group Identification form, you
|
||
|
|
can plan a group profile. </p>
|
||
|
|
</div>
|
||
|
|
<div class="section"><h4 class="sectiontitle">Example: Identifying user groups</h4><div class="p">In this example,
|
||
|
|
different groups need the Pricing and Contract application: <ul><li>The Sales and Marketing department sets prices and creating customer contracts.
|
||
|
|
They own the pricing and contract information.</li>
|
||
|
|
<li>The customer order department changes contract information indirectly.
|
||
|
|
When they process orders, the quantities on the contract change. They need
|
||
|
|
to change pricing and contract information.</li>
|
||
|
|
<li>The order processing people need to look at the credit limit information
|
||
|
|
to plan their work, but they are not allowed to change it. They need to view
|
||
|
|
the credit limit file.</li>
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" width="100%" frame="border" border="1" rules="all"><caption>Table 1. Example: User Group Identification
|
||
|
|
Form</caption><thead align="left"><tr><th colspan="6" valign="top" id="d0e95">User Group Identification
|
||
|
|
Form</th>
|
||
|
|
</tr>
|
||
|
|
</thead>
|
||
|
|
<tbody><tr><td colspan="2" valign="top" headers="d0e95 "> </td>
|
||
|
|
<td colspan="4" valign="top" headers="d0e95 "><span class="uicontrol">Access Needed for Applications</span></td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 "><span class="uicontrol">User Name</span></td>
|
||
|
|
<td valign="top" headers="d0e95 "><span class="uicontrol">Department</span></td>
|
||
|
|
<td valign="top" headers="d0e95 "><span class="uicontrol">APP:</span> A</td>
|
||
|
|
<td valign="top" headers="d0e95 "><span class="uicontrol">APP:</span> B</td>
|
||
|
|
<td valign="top" headers="d0e95 "><span class="uicontrol">APP:</span> C</td>
|
||
|
|
<td valign="top" headers="d0e95 "><span class="uicontrol">APP:</span> D</td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 ">Ken H.</td>
|
||
|
|
<td valign="top" headers="d0e95 ">Order processing</td>
|
||
|
|
<td valign="top" headers="d0e95 ">O</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 ">Karen R.</td>
|
||
|
|
<td valign="top" headers="d0e95 ">Order processing</td>
|
||
|
|
<td valign="top" headers="d0e95 ">O</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 ">Kris T.</td>
|
||
|
|
<td valign="top" headers="d0e95 ">Accounting</td>
|
||
|
|
<td valign="top" headers="d0e95 ">V</td>
|
||
|
|
<td valign="top" headers="d0e95 "> </td>
|
||
|
|
<td valign="top" headers="d0e95 ">V</td>
|
||
|
|
<td valign="top" headers="d0e95 ">O</td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 ">Sandy J.</td>
|
||
|
|
<td valign="top" headers="d0e95 ">Accounting</td>
|
||
|
|
<td valign="top" headers="d0e95 ">V</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">V</td>
|
||
|
|
<td valign="top" headers="d0e95 ">O</td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 ">Peter D.</td>
|
||
|
|
<td valign="top" headers="d0e95 ">Accounting</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 "> </td>
|
||
|
|
<td valign="top" headers="d0e95 ">V</td>
|
||
|
|
<td valign="top" headers="d0e95 ">O</td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 ">Ray W.</td>
|
||
|
|
<td valign="top" headers="d0e95 ">Warehouse</td>
|
||
|
|
<td valign="top" headers="d0e95 ">V</td>
|
||
|
|
<td valign="top" headers="d0e95 ">O</td>
|
||
|
|
<td valign="top" headers="d0e95 ">V</td>
|
||
|
|
<td valign="top" headers="d0e95 "> </td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 ">Rose Q.</td>
|
||
|
|
<td valign="top" headers="d0e95 ">Warehouse</td>
|
||
|
|
<td valign="top" headers="d0e95 ">V</td>
|
||
|
|
<td valign="top" headers="d0e95 ">O</td>
|
||
|
|
<td valign="top" headers="d0e95 ">V</td>
|
||
|
|
<td valign="top" headers="d0e95 "> </td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 ">Roger T.</td>
|
||
|
|
<td valign="top" headers="d0e95 ">Sales and marketing</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">O</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
</tr>
|
||
|
|
<tr><td valign="top" headers="d0e95 ">Sharon J.</td>
|
||
|
|
<td valign="top" headers="d0e95 ">Management</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
<td valign="top" headers="d0e95 ">C</td>
|
||
|
|
</tr>
|
||
|
|
<tr><td colspan="6" valign="top" headers="d0e95 "><div class="note"><span class="notetitle">Note:</span> <ul><li>Use a <kbd class="userinput">V</kbd> (view) if someone only needs to look at
|
||
|
|
the information in the application.</li>
|
||
|
|
<li>Use a <kbd class="userinput">C</kbd> (change) if someone needs to make changes
|
||
|
|
to the information.</li>
|
||
|
|
<li>Use an <kbd class="userinput">O</kbd> (owner) if someone has primary responsibility
|
||
|
|
for the information.</li>
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
</td>
|
||
|
|
</tr>
|
||
|
|
</tbody>
|
||
|
|
</table>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<div>
|
||
|
|
<ul class="ullinks">
|
||
|
|
<li class="ulchildlink"><strong><a href="rzamvplangrpprof.htm">Plan group profiles</a></strong><br />
|
||
|
|
This topic describes the purpose of group profiles and how to design them. Use group profiles to define authorities for a group of users, rather than giving authority to each user individually.</li>
|
||
|
|
<li class="ulchildlink"><strong><a href="rzamvusergrpidworksheet.htm">User group identification worksheet</a></strong><br />
|
||
|
|
This topic describes the user group identification worksheet.</li>
|
||
|
|
<li class="ulchildlink"><strong><a href="rzamvusergrpdescworksheet.htm">User group description worksheet</a></strong><br />
|
||
|
|
This topic describes the user group description worksheet.</li>
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
<div class="familylinks">
|
||
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="rzamvplanusersec.htm" title="Planning user security includes planning all areas where security affects the users on your system.">Plan user security</a></div>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
</body>
|
||
|
|
</html>
|