{"id":65005,"date":"2023-03-15T16:48:38","date_gmt":"2023-03-15T08:48:38","guid":{"rendered":"https:\/\/version-2.com.sg\/?p=65005"},"modified":"2024-09-13T16:31:25","modified_gmt":"2024-09-13T08:31:25","slug":"how-to-streamline-user-permissions-with-organizational-hierarchies","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2023\/03\/how-to-streamline-user-permissions-with-organizational-hierarchies\/","title":{"rendered":"How to streamline user permissions with organizational hierarchies"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\nA common challenge for many businesses is efficiently managing user permissions as new solutions are deployed and adopted. How do you ensure that the right people have the right permissions to access the data they need for their jobs? Missteps on provisioning permissions can lead to unauthorized access to data, creating major headaches for IT and security teams.\n\nOne way around this challenge is to start with solid user and permission management practices that help you assign access to your users, such as role-based access control (RBAC). RBAC is a security approach that authorizes and restricts users\u2019 access based on their roles within an organization. While RBAC is an effective way to manage user access control at scale, you can add extra layers of protection to ensure that the right roles are being assigned. A good example of this would be using hierarchies to propagate the inheritance of permissions.\n\nLet\u2019s take a look at how you can use runZero organizations for data segmentation and hierarchies to streamline user permission management.\n

\nThe role of organizations <\/i><\/h2>\nOrganizations are a powerful feature that allow you to create separate entities for your assets and control what users can do with the organizational data. In runZero, you can use organizations<\/a> to group and manage asset data, Explorers, tasks, sites, and scan configurations. The flexibility of organizations allows you to segment your data by company, department, customers, or however you like. For example, you might want to set up different organizations for each environment you have \u2013 such as development and production \u2013 because you want to segment the data. Or if you\u2019re a service provider, you may have an organization for each one of your customers.\n\nIn some cases, your business may want to set up multiple organizations to manage asset data as well as streamline permissions management. Imagine having to review and assign organizational access for each user. That\u2019s time-consuming and prone to user error. So how can you ensure consistent provisioning of user permissions throughout your organizations?\n

\nIntroducing organizational hierarchies <\/i><\/h2>\nrunZero 3.6<\/a> introduces organizational hierarchies, which enables you to create parent-child relationships between organizations. This approach is based on a top-down permissions distribution model, where the child organizations inherit the permissions configured within the parent organization.\n\n\n\nThe parent organization sets the minimum permission level<\/a> a user has to that organization and any children. Child organizations with lower permissions than the parent organization will inherit the effective higher permission. For example, if the parent organization has a user\u2019s permissions set to annotator, then the child organizations can be upgraded to user or administrator, but downgraded permissions won\u2019t have any effect.\n\nImagine you have a parent organization called Mom Org<\/code> that has a child organization called Baby Org<\/code>. Within Mom Org<\/code>, a user named Chris has been assigned an administrator role. As a result, Chris can access the Baby Org<\/code> organization as an administrator.\n\nLet\u2019s take a look at how you can set up organizational hierarchies in runZero.\n

How to set up organizational hierarchies in runZero <\/i><\/h2>\nTo set up an organizational hierarchy, you can either create a new organization<\/a> or modify an existing one. You can always edit your organizations and assign a new parent (or no parent at all).\n\nHere\u2019s how you can assign a parent organization:\n
    \n \t
  1. Create a new organization<\/a><\/strong> or edit an existing organization<\/a><\/strong>.<\/li>\n \t
  2. Make sure to provide a name<\/strong> and description<\/strong> for the organization. This information captures context about the organization and the type of data it contains.<\/li>\n \t
  3. Make sure to set any expiration dates<\/strong> for stale assets, offline assets, and scan data. This determines how long these data types are stored by runZero.<\/li>\n \t
  4. Under parent settings<\/strong>:\n