User Rights Management - User Profiles

User rights management is not just a technical detail, but an essential part of an organization's risk management, information security, and quality of operations. When using a system that ties together a huge amount of valuable data, it is also important to be aware of the importance of information security and the risks of misuse.

At Koho, the management of user rights is quite simple, but the needs and special characteristics of the organization need to be defined on a case-by-case basis. Here are some best practices to support that process.

Important

Rights should not be granted just in case. Extra privileges increase security risks, the possibility of errors, and make it more difficult to trace problems.

Best practices

Role-Based Access Control (RBAC)

In a role-based model, permissions are assigned based on the job description and area of responsibility. Users are not managed individually, but are assigned to predefined roles, such as "Sales Assistant", "Project Manager" or "Payroll Accountant", who have been given just the right amount of rights to perform their tasks.

• Maintenance is significantly easier when changes are made at the role level

• All those in the same position will have uniform rights

• Access to information only for those for whom it is necessary for the tasks.

Principle of Least Privilege (PoLP)

This principle means that the user is only given the permissions that are necessary to perform their job tasks – no more. The principle brings both security and clarity.

• For example, the salesperson does not have the right to manage user accounts or browse the working hours of others.

Segregation of Duties (SoD)

The SoD principle prevents an individual user from controlling the entire business process from start to finish – this prevents misuse and fraud attempts. For example, the same person is not allowed to create and approve purchase invoices or process and pay salaries.

Practical example:

• User A creates a purchase order

• Checked by user B

• User C accepts it for payment.

Periodic review of licenses and lifecycle management

Permissions are long-lasting, but not forever—employee roles change, new people are hired, and employment ends. Access management should be seen as a continuous lifecycle.

• Issuance: Only through an approved process

• Changes: Documenting and justifying

• Deletion: Done as soon as the rights are no longer needed – for example, when the role changes or the employment ends.

It is recommended to carry out a user rights review at least quarterly and always in connection with significant changes. All rights, changes and justifications must be documented transparently, which facilitates auditing and internal control.

Don't get anxious about the control!

Documentation, processes and justifications may sound heavy, but at their simplest, we are talking about very small actions. More important than the amount of text is that the parties involved are on the same page, and that the changes leave some kind of trace.

Defining roles in Koho

User profiles can be maintained from Settings - Users - Profiles. And new ones can be created by clicking the Profile button.

It is possible to define dozens of separate rights and settings for a profile. At this point, it is especially useful to think about necessity. Find and define the points that are needed in the task in question and forbid the rest.