Application Security

Application Security

1. In Pega application, you configure access control security on user roles using:

   • role-based access control (RBAC)
     • You use RBAC when you want to restrict users roles to access only certain UI elements to:
       • a. perform only certain actions on the UI
       • b. have any access to a class
     • You configure RBAC access by defining roles with the desired authorization and privileges. One or more roles are then associate with an acess group
     • use three key rules:
       • Roles (Rule-Access-Rolename)
       • Access of roles to objects (Rule-Access-Role-Obj)
       • Deny rules (Rule-Access-Deny-Obj)

2. If an application requires further security, you can configure:

   • attribute-based access control (ABAC)
     • You use ABAC to restrict access:
       • a. to specific instances of classes
       • b. to specific properties within instances
       • independent of an access group role
     • You use two rules:
       • Access Control Policies (Rule-Access-Policy)
       • Access Control Policy Conditions (Rule-Access-PolicyCondition)
     • Restrictions are enforced through access control policies that specify the type of access is allowed. You define a set of a policy conditions that compare user properties or other information on the clipboard to properties in the restricted class.

3. Access control depends on two factors:

   • Authentication
     • Confirms the identity of a user and verifies that the user is allowed access to an application.
     • In Pega the records for Operator ID, Access Group and Application allow authentication of a user.
   • Authorization
     • determine what a data the user can view and what actions the user can perform

4. Access Groups

   • Grants access to specific functionality within your application.
   • You can create multiple access groups for the same application to achieve differents levels of access control
   • A user can belong to multiple access groups, but only one access group is active at a single time
   • Each access group identifies one or more access roles

5. Access Role

   • Categorize users according to the job function
   • Each access role represents how a set of users interacts with an application to create and process cases

6. Relationship of access groups and access roles

   • When an access group lists more than one role, Pega applies the settings for all the roles listed
   • By applying more than one role to an access group you can:
     • Design Modular
     • Reusable roles
     • Combine those roles to meet complex security needs
   • If two or more roles conflict over whether to allow or deny an action, Pega applies the most permissive setting across all the applied roles

7. RBAC access control record types

   • Access Deny
     • By default, Pega denies access to all instances of a class unless you explicitly grant access to users
     • You use the Access Deny record to explicitly deny access to any action for instances of a class
   • Access Whens
     • You configure Access When record at the specific class and instance level
   • Access of Role to Object (ARO)
     • You use an ARO record to define the access control settings for instances of a specific class.
     • Each ARO identifies set of actions that a role can perform on instances of the specified class
     • Each ARO record correspondes to a unique combination of access role and class
   • Privillege
     • To allow or deny access to certain records, such as flow actions and correspondence, you configure a privillege.
     • The privillege is a token
     • The privillege record contains no information
     • You can not configure privilege for an access group
   • Class
     • ARO rules specified whether user roles have access or no access for each a six functions: Open, Modify, Delete, Perform, Reports and History

8. Access Manager

   • Provides an easy to use interface for managing applications security
   • You can use to view and edit the current access settings for a given role one in one place instead of editing or configuring dozens of ARO individual roles

9. Characteristcs of ABAC access control policies

   • All Pega ABAC access control policies have key characteristics
     • 1. Class Limitations
       • Access control policies can be defined only for Assign-, Data- and Work- classes that are in the Pega plataform database
     • 2. ABAC Inheritance funcionality
       • Access policy rules can be inherited from multiple classes
       • Access is allowed only when all policy conditions are satisfied
     • 3. AND Conditions
       • If multiples access policies apply, Access is allowed only when all policy conditions are satisfied
       • Even if ABAC policy grants access, RBAC also applies and must also grant access
     • 4. Control enforcement
       • Access control policies are enforced everywhere in pega plataform no just within UI. Including areas: All reporting rules, Search and Custon SQLs