Security Guide - Security (Allocating Security Permissions)

Security

The Security permission defines whether the User or User Group can access and alter the security settings of the selected item. The Security permission is used in conjunction with the Configure permission. When working with User accounts, User Groups, and Groups that contain User accounts, User Patterns or User Groups, the following rules apply:

To configure, delete, rename, modify, or convert a User Group, User account or User Pattern, you need to have the Configure and Security permissions for that User Group, User account or User Pattern.
To create, copy, or import a User Group, User account or User Pattern, you need to have the Configure and Security permissions for the Group or system that is to contain the new User Group, User account, or User Pattern.
To move a User Group, User account or User Pattern, you need to have the Configure and Security permissions for both the User Group, User account or User Pattern and the target Group or system (the Group or system to where the Group, User account or User Pattern is being moved).

These rules also apply to Groups that contain User Groups, User accounts or User Patterns.

Availability: Is available to any User or User Group with the Security permission for the selected item. The Security permission cannot be restricted (you can only stop Users and User Groups from having access to the security settings by denying them the Security permission for database items on a per item basis).

NOTICE

SECURITY THREAT

On systems on which ClearSCADA can Create users automatically from group membership, the incorrect assignment of security permissions on User Patterns and User Groups can compromise the security of the system. Always restrict the security permissions that are allocated to User Patterns, and to User Groups that are integrated with Windows domain groups or LDAP user groups. Only assign those permissions that are actually required, to help prevent the automatic creation of new user accounts that allow Windows or LDAP users to perform high-level tasks, such as shutting down the server.

Failure to follow these instructions can result in equipment damage.