Implementation Guide › Planning Your Enterprise Implementation › Educating and Training Staff

Educating and Training Staff

Part of the role of the security administrator is to tell the system users what they need to know to work without disruption when CA Access Control is installed.

The amount of detailed information each user needs to know about CA Access Control depends on the functions you authorize the person to use. Examples of information required by various types of system users include the following:

• PUPM users

  How to check out and check in privileged account passwords and understand when to request access to privileged accounts and when to break glass.

• All users defined in the CA Access Control endpoint databases
  • How to identify themselves to the system by a user name and a password and how to change a password. They should also be aware of the significance of their password to system security.
  • Be familiar with the Password Manager, If you implement password policy validation.
  • How to use the secons -d- and secons ‑d+ commands that disable and enable concurrent logins. Concurrent logins are multiple sessions initiated by the same user onto a system from more than one terminal at the same time.
  • Be familiar with the sesudo command, which enables user substitution based on predefined access rules with or without password checking.
• Technical support personnel

  Be familiar with migration considerations and with the steps required to install or reinstall CA Access Control. Users who maintain the database must be familiar with the database utilities.

• Auditors

  Users with the AUDITOR attribute should be familiar with the auditing tools (CA Access Control Endpoint Management and the seaudit utility).

  Note: For more information about the seaudit utility, see the Reference Guide.

• Programmers writing unauthorized applications

  Programmers can use the CA Access Control* function library in their applications to request security‑related services, including controlling access to protected resources (by using the SEOSROUTE_RequestAuth function). Your installation can create installation‑defined resource classes. If your installation creates records in those classes, an application can issue a SEOSROUTE_RequestAuth command to check whether a user has sufficient authority to complete an action. The level of authority required for a particular user action is determined by the way the application invokes the SEOSROUTE_RequestAuth function.

  Note: For more information about the CA Access Control API, see the SDK Guide.

• Programmers writing authorized applications

  Programmers writing authorized applications (programs that run with the SERVER attribute) can use the CA Access Control* function library to request security‑related services, including:

  • User identification and verification
  • User logout service
  • User authorization request