Building a new application - when do you implement security?

[johnpaul]

Hi all,

I am very new to QV.

I have been reviewing the forums, but just wondering if some experienced users could shed some light.

My customer has 40 deparments and 40 deparment managers. Each department manger needs to see only their data (sales & expenses) and the benchmark average of all deparments.

We are using community server, so section access is what I am expecting to use to restrict data.

My quesiton is should I start off by implementing security, or should I build a open model to begin with and when the corporate head office is happy with the design, then introduce the security?

Also, would perhaps set analysis be secure enough to restrcit the data set based on the user logged in?

Thanks in advance, Jp.

[prieper]

Hi,

we have three different steps:

1: initial ideas are created in each developer's directory, where normally only developers have access to. Results, screens etc are showed in smaller circle.

2. Thereafter the application is moved into "Testing"-folders, usually also without access-restrictions (a bit depending on sensivity of the data). Applications here should be tested and further improved on basis of a broader audience (inhouse). Also Data must not be complete and do not always require to be 100% accurate. This phase should not take longer than 4-6 weeks.

3. File will be moved into working-directories, access-rights are defined and tiered into various depth. Here files will be open to inhouse and externals.

HTH

Peter

[#3]

No set analysis is not secure enough. The data may be hidden but it is still available to anyone.

[Anonymous]

Hi JP,
As a rule (and I can't recall a single exception), I build the working application, and after that add the security if needed. Sometimes there could be minor changes in the data model to support the security requirements.

[Oleg_Troyansky]

HI JP,

welcome aboard! I can only summarize all the answers above.

1. Typically, the application is first developed, presented, and tested, and then at the end the security is added. A word of caution - ALWAYS make a separate copy of your application before adding Section Access, because you will inevitably lock yourself out at the first attempt. So many people in this forum had started from losing their applications...

2. Set Analysis cannot be used for security. Use "Initial Data Reduction Based on Section Access" flag on the Security tab in Document Properties.

3. If you have 40 departments, and if your data set is big, and if you are using Publisher - you might even consider slicing the document into 40 slices (using Publisher). This way, each Manager only needs to deal with approx. 2.5% of the overall data volume, hence the application should be much lighter. On the flip side, the server will have to open 40 documents instead of 1, so it might be heavier for the server - there are obvious pros and cons that need to be tested and weighed...

good luck!

Oleg

[#6]

If you have Set Analysis commands and you loop and reduce will the Set Analysis commands become invalid because it has lost the data? Is there way to prevent reducing the data along with securing?

Hope that makes sense...

[#7]

No you will be fine. Set analysis makes the selections it can and ignores any selections it cannot make. If 1 of 2 values are eliminated from a column by loop and reduce, the remaining set analysis selection will still be made.

[#8]

Hi Jonh..

Do you think thats answers was helpfull enough?

Im also agree with most of the guys ...

• Set Analysis is not used for security reasons
• Finish you developmen first, double check everything and then implement the Section Access.

Do you know how to implement the security that you need in your applications ? Do you need some help about it ?

Best Regards