Sisense Security Architecture

Sisense is built around a robust and flexible security architecture that is both comprehensive and intuitive. This architecture has been designed to ensure security processes are enforced while scaling to enterprise deployments of Sisense. This includes the ability to secure dashboards and data as well as implement custom security requirements that suit your organization. This section provides a general overview of the main security features.

Security is based around three levels associated with sets of security features. The diagram below maps this security architecture on a system, data and object level.

security 1

System Level Security

System-level security encompasses security features for role-based settings and integration options. This includes user and server management, connection to an active directory, Single Sign-On (SSO) implementation, and use of the security REST API.

User Management

You can assign three primary roles to Sisense users:

  • Viewers: Can view dashboards
  • Designers: Can create and edit dashboards
  • Administrators: Can create users and user groups, set up Active Directory, and more.

These roles can be defined on either a user or group level to determine sharing, access and security. To learn more about user roles, click here.

ElastiCube Server Access Rights

You can assign access rights to different ElastiCube servers for individual users, groups or to everyone. These settings allow the management of different environments such as a testing and production server, or servers for specific projects or departments. See also ElastiCube Server and ElastiCube Security.

Active Directory

Connect existing users and groups from your organization’s Active Directory to define security and sharing properties and reduce deployment time. This removes ‘password fatigue’ as users can rely on existing credentials while organizational policies around security credentials such as updates can be enforced. See also Integrating Active Directory.

Single Sign-On (SSO)

SSO facilitates seamless integration between Sisense and other systems in your organization while offering standardization of authentication policies across your organization. This can improve user productivity by avoiding password fatigue and reduce support overhead. See also Configuring SSO.

REST API

The Security REST API provide access to parameters to integrate and automate restrictions and access control based on existing settings and standards. Specify access rights and security to dashboards, ElastiCubes and data. Manage users via the API to create, edit and assign new users or groups. Click here to visit the API documentation site.

Object Level Security

Object security defines access rights for different users and groups to various components within Sisense. The two main objects are dashboards and ElastiCubes.

Dashboards

You can share dashboards on either a user or group level.  The sharing options include the configuration of access rights for all users as well as whether users defined as designers may edit the dashboard.  The sharing options also include subscription settings that define which users and groups will receive email reports. See also Sharing Dashboards.

ElastiCubes

You can define access rights to different ElastiCubes on a user or group level. This enables flexibility to create ElastiCubes for specific user or group needs while offering strict access control. See also Assigning Access Rights to an ElastiCube.

Data Level Security

Data access must provide data to people only to the extent that they need to complete their jobs. Data Level Security provides the necessary control to enforce varying degrees of data visibility and access to support the separation of duties. A single dashboard can be shared with many users, but each viewer sees only data relevant to their needs. This reduces both development time and provides for security.

Security on the Row Level

You can grant user and group permissions to specific rows in the data. For each ElastiCube, you can apply multiple rules to enforce granular access control.

Row Level Defaults

Control which data is accessible for users or groups that do not have explicit security rules. For example, enable new employees to access a restricted data set until they are added to relevant groups. You can set defaults to include everything, nothing or view based on a security rule.

See more in Data Security below.

Security Levels

Sisense provides three levels of security:

ElastiCube Server and ElastiCube Security

What is ElastiCube Server and ElastiCube Security?

Sisense enables you to define access rights to control which users can access which ElastiCubes, whether they are creating new dashboards or trying to access shared dashboards.

ElastiCube Server Security – Use Case Example

You may already have access to an ElastiCube Server named Production. As an administrator, you want to create a Staging environment with its own ElastiCube Server; and you do not want other users to be exposed to it. In this case, you can set the ElastiCube Server rights to allow only you to access it.

ElastiCube Security – Use Case Example

You may have an ElastiCube named Marketing and only want the CEO and Marketing team to have access to it. You can grant rights only to them using ElastiCube Security, thus denying anyone else access.

How Does ElastiCube Security Work?

  • You can define that users/user groups have access to either:
    • An entire ElastiCube Server, including all the ElastiCubes on the ElastiCube Server.
      and/or
    • Only to specific ElastiCubes.
  • By default, all users are allowed to access the data of all ElastiCube Servers and ElastiCubes. Once you start assigning users/user groups access rights to an ElastiCube Server/ElastiCube, then only the users/user groups that you assign can access that ElastiCube Server/ElastiCube.
  • Access to ElastiCube Servers/ElastiCubes is by Grant rules. There are no Deny rule options.
  • When no access rights have been defined for a specific ElastiCube, then that ElastiCube inherits its access rights from the ElastiCube Server settings.
  • When a user attempts to access a Dashboard using a direct link and that dashboard is based on an ElastiCube to which that user does not have access rights, a security message is displayed.
  • When access rights are defined for a specific ElastiCube, then those access rights override the ElastiCube Server access rights. This means that a user can access an ElastiCube to which he/she is assigned access, even if that user has not been assigned access rights to the ElastiCube server on which that ElastiCube is stored.

Assigning Access Rights to an ElastiCube Server

By default, when you add an ElastiCube server (as described in Manage ElastiCubes), all users are allowed to access it.

A user that has access to an ElastiCube server can access all the ElastiCubes on it.

Once you start assigning users/user groups access rights to the ElastiCube server, then only the users/user groups that you assign can access the data of the ElastiCube Server.

To assign access rights to access an ElastiCube Server:

  1. Click ADMIN in the upper right corner and select the ELASTICUBES tab in the menu.
  1. To define that an ElastiCube Server can only be accessed by specific users/user groups, hover over the list of ElastiCubes under the server name, and click Access Rights next to the server name.
  1. Enter the users/user groups that you want to give access to this ElastiCube Server.
  2. Click SAVE.

Assigning Access Rights to an ElastiCube

By default, all users are allowed to access each ElastiCube.

You can define which users are allowed to access each specific ElastiCube. You can assign a user access to an ElastiCube even when the user does not have access to the entire ElastiCube server.

Once you start assigning specific users/user groups access rights to this ElastiCube, then only the users/user groups that you assign can access the ElastiCube.

To assign access rights to an ElastiCube:

  1. Click ADMIN in the upper right corner and select the ELASTICUBES tab in the menu.
  1. In the ElastiCube’s menu on the right, click Access Rights. By default this list is empty, meaning that all users have access rights to this ElastiCube.
    access rights

Security - 222

  1. Enter the users/user groups allowed to access this ElastiCube. If for example you add your own name, then only you will have access to the ElastiCube.
  2. Click SAVE.

Data Security

Data security in Sisense can be divided into two types, data encryption and data access. Data communication is related to how data is secured by Sisense while be imported into Sisense and written on your server’s disk.

When data is imported into Sisense, the protocol used depends on the protocols supported by the data source. Sisense supports importing data over SSL, if the source supports it. Sisense supports SSL for data Retrieval, for example, when viewing data in dashboards.

Configuration data, such as account credentials and authorization profiles, are encrypted prior to being written to the disk. The encryption technology used by Sisense includes:
1. SHA-256
2. TripleDES
3. AES-256

For data at rest, Sisense supports OS based disk encryption, Windows file system encryption ​- Transparent Data Encryption (TDE). ​When using Windows transparent encryption, the key pair (private/public) is bound to the user identity. For more information, click here.

The second type of data security is data access. This type of data secruity refers to who can access your data after its imported into Sisense and displayed in a dashbooard.

What is Data Access Security?

Sisense enables you to define Data Security Rules that control which users can access which portions of the raw data in an ElastiCube, down to row granularity. For example:

  • Each widget only shows the data permitted by the Data Security Rules that apply, including totals, averages and so on.
  • The data browsers used while building dashboards and widgets only show the data permitted by the Data Security Rules that apply.
  • You can define a single dashboard that automatically displays different results for each user (or user group), based on the rows that user is permitted to see.

Use Case Example

  • A Sales Order table has a column representing the salesperson that closed a deal.
  • You created a quarterly performance dashboard for your salespeople, but want each of them to see only their own data.
  • You do not want any of them to be exposed to data that represents the performance of others.

How Does Data Access Security Work?

Each ElastiCube contains tables and each table contains fields. A Data Security Rule defines that a specific user can only see any data of an entire row of a table, if a specific field in that row has a specific value(s).

For example, in a Sales widget a salesperson (for example, Dan) will only see the sales amounts from the rows of a Sales ElastiCube whose Salesperson field contains the value Dan (rows 1 and 4).

Sales Table

# Salesperson Product Amount
1 Dan HD-TV $100
2 Matthew TV $300
3 Amber Media Center $700
4 Dan Player $200
5 Matthew Air Conditioner $600

Dan will not see any part of a row in the ElastiCube that does not contain the value Dan in the Salesperson field, nor will any amounts from this row be included in totals.

Note: The entire row of data is not seen by the relevant user even when the field to which the rule applies does not appear in the widget.

If a widget that shows the amount spent per product is shared with Dan , then he will only see HD-TV and Player and the sales total will be 300$.

Defining Data Access Security for an ElastiCube

Each Data Security Rule applies to a specific field in an ElastiCube and to specific user(s)/user group(s). It enables you to define the values that must be contained in a specific field to enable that entire row of data to be available to a user.

To access Data Security:

  1. Click ADMIN in the upper right corner and select the ELASTICUBES tab in the menu.
  2. In the ElastiCube’s menu on the right, click Data Security.

 d sec

If no data security rules have yet been defined for this ElastiCube, then the following message is displayed:

 

  1. Click the ADD FIELD button to display a list of the fields in this ElastiCube.

 Security - 9

  1. Select a field. For example, Brand. The following window is then displayed in which you can define rules.
    Note: You cannot select date type fields.

 access4

The left side of this table enables you to define which users/user groups can access this data. Click + Add Restriction and start typing into the Restricted User/Groups field to get a drop-down list.

Add as many users/user groups, as necessary.

Security - 999

The right side of this window enables you to define which values the specified users/user groups are permitted to see.

Start typing into the Values field to get a drop-down list.

 Security - 12

In this example, Everyone can only view rows that have Addimantor Worldwide in the Brand field.

Multiple values can be selected.

The value of numeric type fields must be typed into this field, as no auto-complete option appears for numeric type fields.

Alternatively, you can select:

  • Everything: To specify that the selected users/user groups can see this data no matter what the value is in this field.
  • Nothing: To specify that the selected users/user groups cannot see this data no matter what the value is in this field.

For example, you can define that the following Users/User Groups must have the following values in the Product Category column to enable them to see their data row in a widget.

# User/User Group Product Category
1 Management Everything
2 Bob Apple Mac Desktops
3 Don Calculators, Camera Flashes
4 Everyone else Nothing

This means that management can see the data of all Product Categories, Don can only see the data of Calculators and Camera Flashes, Bob can only see the data of Apple Mac Desktops, and Everyone else won’t see anything.

How Does Data Level Security Work for Tables with Relationships?

Tables in an ElastiCube may have a relationship between them.

As described above, each widget only shows any data of an entire row of a table, if a specific field in that row has a specific value.

In addition, a widget may further restrict the data shown to a specific user when a rule is defined for a table that has a relationship to a table that has a field in the widget.

This means that a widget only shows the data permitted by the combined Data Security Rules assigned to all the tables that have any field in the widget.

As described above, the entire data row is restricted even when the field to which the rule applies does not appear in the widget. The entire row of data is also restricted even when the field of the relationship between the two tables does not appear in the widget.

Use Case ExampleExpanding Upon the Example Above

  • The Sales table has a column that has a relationship with a Deal Contacts table that holds the contacts that were involved in each deal.
  • You created a Deal Contacts widget for your salespersons.
  • As described in the example above, the Sales table has a Data Security Rule that maps each user to his/her matching field value, so that each sales person only sees their own data.
  • Even though the Deal Contacts table does not have any Data Security Rules defined for it, the Deal Contacts widget only enables each sales person to see the contacts associated with their own sales, because of the Data Security Rule assigned to the Sales table.