Revision as of 08:52, 7 October 2021

Business Security Settings

These settings are used to control system security.

To access the security settings, follow these steps:

1. Click on the 9-square menu icon on the top right of your page.

2. Under the heading Configuration, select Global Settings. 

3. Click into the Security tab.

4.  The Business Security Settings, which will each be explained below, are displayed under the first heading on the page.

Security Settings Tab in Global Settings

Password and Activation Policies

The Password Policy is used to control the length and complexity of passwords, password expiration and history, the number of retries that the user is allowed, and the lockout time for the account if they exceed the number of retries. Captcha Validation can be enabled here as well. Click here for detailed information.

Privacy and Security Policies

The Privacy and Security Policies allows organizations to better highlight their privacy and other stated policies, provides tools to manage country and language combinations, and places persistent links to policies on login pages and user portals.

Organization Security Matrix

Allows system administrators to restrict interaction with organizations and associated categories. The Organization Security Matrix defines how users can interact with company data, based on the way they need to interact with the data. In order to do this you will need to Enable Organization and User Security Matrix. Once this is toggled on, the matrix can be enabled per role.

User Security Matrix

Allows system administrators to restrict interaction with the application and associated entities. The User Security Matrix defines how users can interact with user data, based on the way they need to interact with the data. In order to do this you will need to Enable Organization and User Security Matrix. Once this is toggled on, the matrix can be enabled per role.

System Feature Permissions

Allows for system administrators to personalize their copy of SmartSimple and to make various system features available to users in different roles. Some of the features located here include: Batch Update, Email Broadcast, SmartFolder Access, Emulation Mode, Personal Dashboards, SmartCards, and many more.

System Visibility Permissions

Allows for system administrators to personalize their copy of SmartSimple and to make various system objects available to users in different roles.

System Configuration Lock

The Instance Lock-Down provides the ability to remove access to all settings in your copy of SmartSimple using a global system-lock password. Click here for details on how to use this feature.

Enable Organization and User Security Matrix

Switch the Organization and User Security Matrix off or on using this toggle.

Enable Organization Record Lock

Prevent concurrent edit access to offices & organizations by toggling this on. Organization records which are presently being accessed in Edit Mode by a given user will be locked to other users attempting to edit the record.

Enable User Record Lock

Prevent concurrent edit access to staff & contacts by toggling this on. User records which are presently being accessed in Edit Mode by a given user will be locked to other users attempting to edit the record.

Enable Cookie Usage Acceptance

Toggling this on will require users to accept the use of cookies from the login page.

Email Security Settings

The Email & Email Broadcast Security settings are used to control which recipients users are allowed to send email and email broadcasts to be based on their role. Click here for detailed information.

Data Categories

Configure Data Category settings

Data Policies

Configure Data Policy settings

Anonymize Record Lock Owner

Select roles for those users who will not see the details of who has the record locked

Session Timeout

The Session Timeout controls how long a user can be inactive in their browser before they are automatically logged out by the system. See Session Timeout for more information.

System Security Settings

You can access the Security Settings, otherwise known as the System Security, from the same page as the Business Security options.

1. Click on the 9-square menu icon on the top right of your page.

2. Under the heading Configuration, select Global Settings..

3. Click into the Security tab.

4. Scroll down until you see the System Security heading. 

System Security Settings from Global Settings

Enable Enhanced Security Mode

Preset and disable configurations on system security related options. This will also disable legacy applications.

Enable URL Parameter Encryption

This setting will encrypt object IDs such as custom field IDs, userid, companyid, activity. This enhances security by making it impossible to guess URLs.

Enable Logout

The system can be configured to automatically logout the user and store the session end time in the user log whenever the Logout button is clicked, the user navigates to a different website or when the browser is closed.
A confirmation message can also be enabled to confirm that the user will be logged out.

Disable External Login Shortcut

This setting will disable the use of the external login shortcut (exlogin) from the URL.

Disable Session Timeout Alert

If Session Timeout is set, this setting will disable the 30-second alert and login prompt pop-ups.

Disable Secure Session Management

This Global System Security Setting will disable the validation for matching session IP and browser agent which is one part of the security features in the platform that protect against Cross Site Framing attacks.

Options if users are being randomly logged out:

1. Set the network proxy to sticky sessions when communicating with SmartSimple
2. Set the network proxy to bypass the proxy and just direct connect from the desktop/laptop computer to SmartSimple
3. Disable the Secure Session Management setting and accept the potential risk

Disable Cross-Site Framing Restriction

Disable cross-site framing restriction, and allow SmartSimple pages to be directly embedded within external sites outside the current server domain.

Disable HTTP Cache Control

Disable HTTP cache control no-cache restriction.

Disable Concurrent Login Check

Allows same user to be logged in from multiple sessions. Primarily used for load testing purposes, and strongly recommended that this is not set when going live.

Suppress Local Administrator Alert

The e-mail notification sent to all current administrators when a new Local Administrator is created can be suppressed.