Organizational Integration

Typical scenario

In more complex environments with multiple hosts and applications, usually the scenario is as follows:

The administration of vWAF itself is carried out centrally, e.g. by a designated staff member specialized in network security. In particular, this concerns the integration into the IT infrastructure, as well as the management of the web applications being protected and of the persons who are granted access.

The individual web applications are protected decentrally by different designated staff members. These persons only have access to the security configuration of “their” web application.

In addition, sometimes there are also persons who only need to perform very particular tasks and who therefore only need limited access rights.

User groups

In vWAF you can assign users to different user groups:

• zeusafm Administrator

  Has all rights. Can edit the security configuration for all applications without having to be assigned those rights specifically. Sets up new applications and can create new administrators and user groups.

• Application Administrator

  Edits only the security configurations of the applications that were assigned to him/her by the zeusafm Administrator user. Can only view the global vWAF configuration but can’t edit it. For example, can’t add new applications and users. In the navigation area, only sees “his”/“her” applications, which might be only a subset of all the applications protected by vWAF.

• PCI Auditor

  This is a special user group designed for persons who conduct Payment Card Industry (PCI) audits. Users of this group can view the entire configuration except for application- specific log files and application-specific statistics, but they can’t change any configuration settings.

• User defined user groups

  Permissions can be fully customized.

Multiple assignments

A user can be a member of any number of user groups. Each user group grants its specific read/write permissions to the user.

Likewise, an application can have as many Application Administrators as required. To guarantee continuous support in the event of holidays and illnesses, typically at least two persons should be assigned for the management of each application.

Example scenario

A company could map its hosts to the following applications and entrust the administration to several persons:

• For each application, there are two Application Administrators. The persons “smiller” and “ajohnson” as well as “jsmith” and “rpeters” are each assigned two applications. The persons “awinter” and “tswenson” are responsible only for the “webshop” application.

• In addition to the Application Administrators, there are also the two staff members “jmccloud” and “rmcdonald”. As a member of the “ zeusafm Administrator” user group they can make system-wide settings and can administrate all applications.

• As a member of the management department, “ppowers” only wants to monitor email reports for the webshop. For this purpose, a user-defined user group “webshopmonitoring” has been created, and “ppowers” is assigned to just this one group.

For more information regarding management of users, see User Management and Group Management.

What happens in the case of simultaneous editing?

When logging in, vWAF always loads the active configuration. If two administrators log in at the same time, each edits a copy of the version at the time they logged in. Each administrator can commit and activate his/her new version. At the end, the version of the administrator who last activated it remains active.