Hello!
I don't claim to be a security expert as such, but I've worked with EA deployments in defence as well as finance.
Across the EA15 presentations videos I see that I could make multiple root nodes in a project and limit their visibility so users can't even see the root node.
Would this feature help me acheive my goals ?
Probably not.
Yes, I guess that is row level visibility feature being demonstrated
"Demonstrated" is the operative word here. This is fairly new functionality in EA, and there may be subtleties and pitfalls.
I would not trust this mechanism to meet any information security requirements without having done a proper analysis in the context of the proposed deployment.
One thing to look out for with EA and data access is that EA is just a client, and it requires all users to have read
and write access to the underlying database. This includes users you may designate as "read-only" and place in a special EA security group with minimal permissions (eg, no permission to change anything or export anything). In other words, if a user with any level of access to an EA project were to use a raw SQL client, such as Microsoft's SQL Server Management Studio, they can
access and modify all project content.
Row-level security has been introduced to help address this, but there is no public documentation that goes into any detail beyond the fact that row-level security is applied only to 24 "critical" tables (out of the 94 tables in EA's database schema). However,
the documentation does state explicitly that "only models hosted by a Pro Cloud Server are able to make use of this feature", so for client users the old access model still applies.
This means that as long as your users are permitted to connect to the project with the EA client, EA's "visibility levels" feature (or row-level security) does not add any protection from malicious data leakage or corruption.
Since the EA client's security model is trivial to bypass, the only way to achieve meaningful security is to use the security features of the underlying database. This means that the project (which is essentially the same as a database) is the smallest unit at which security protections can be applied.
- 1 team should not see other one's project [content]
The only way to do this is separate projects.
- On the arborescence it should start on its project and only see it
This is automatic with separate projects.
- I should be able to make reports about which user has access to a project (currently it's easily done be reporting AD groups)
While it would be pretty straightforward to create an in-EA document generation template which lists the content of t_secusers, this doesn't tell you who has access to the database by virtue of being a member of the relevant AD group. For that you still need to look in the AD.
Unfortunately, this all means that neither of your proposed solutions work.
- Option 1 : Keep the 1 database per project, use only 1 AD group to give access to every database on the DB and enable security on every new project selecting only the users allowed to access the project
This does not prevent members of the 1 AD group from accessing all databases with Management Studio. From a security perspective, this is not an option.
- Option 2 : Have 1 database for all projects, use only 1 AD group and manage the security within EA
This is also not an option as discussed above.
Currently we have a model which is painful, each project has it own database and access are controlled via AD groups. So we have as many groups and DB as we have projects (currently more than 100 ..).
At the end of the day, this is the only model that provides any actual security.
Now if in your setup users can't do things like install their own software, use raw SQL clients or run scripts, it might be possible to make the EA security model work. But that would depend on a number of other factors as well. In the general case, the EA client's access model provides no actual security.
I would not let security kill my business.
That's as may be, but there are several industries where security
is the business, or is at least integral to it. In those, convenience of use takes a backseat to security, and in those, EA has to be set up the way I've described.
/Uffe
