PowerProtect Data Manager Appliance 5.15.0.0 Security Configuration Guide for DM5500

Example: protecting and isolating confidential information with scopes of authority

The following example illustrates a practical application for defining scopes of authority through roles and resource groups.

Your environment has the following configuration:

• Three protection storage systems named Finance, Engineering, and HumanResources.
• Three asset sources named Payroll, Prototypes, and Investigations.
• Three users named Gurpreet, Lisa, and Eric, all with the Restore Administrator role.
• Each named user administers the assets for a different department.

Without resource groups, there is no defined scope of authority. All three users can restore from a backup of any asset source, even if those assets belong to another department and the backups contain confidential information.

To ensure information security, you can define three resource groups: FinDeptRG, EngDeptRG, and HRDeptRG. Now you can use these resource groups to create separate scopes of authority for each user:

The three users still share a common role in the same organization. However, the separate scopes prevent a user from acting on resources that belong to another department.