Managing accounts of application administrators and users

Kaspersky Anti Targeted Attack Platform provides accounts for servers with the following components:

• Sensor. Administrator account for working in the application administrator menu and in the server management console (in Technical Support Mode).

  The 'admin' account is used by default.

• Sandbox. Administrator account for working in the application administrator menu, in the server management console (in Technical Support Mode) and in the Sandbox web interface.

  The 'admin' account is used by default.

• Central Node. The following accounts:
  • Administrator account for working in the application administrator menu and in the server management console (in Technical Support Mode).

    The "admin" account that was created during application installation is used by default.

  • Local administrator account of the application web interface.

    The "Administrator" account that was created during application installation is used by default. You can create other administrator accounts for the application web interface after installation.

  • Administrator account of the application web interface.
  • Application web interface user accounts with the Security auditor, Security officer, and Senior security officer roles.

Data from each of these accounts is stored on the server hosting the application component to which the account belongs.

In distributed solution and multitenancy mode, data from each of these accounts is stored on the PCN and on the server hosting the application component to which the account belongs.

Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

The administrator account used for working in the server management console has unlimited rights to manage the server hosting the application component to which the account belongs (superuser rights). Under this account, you can turn off or restart a server, or modify the settings of the application in Technical Support Mode in the server management console.

An administrator account for working in the management console of a server (admin) has unlimited access to data on that server. The password of the administrator account for working in the server management console must be strong. The administrator must take steps to ensure the security of the servers. The administrator bears responsibility for access to data stored on servers.

An account with the Administrator role can add, enable and disable application user accounts, and change the passwords of application administrator accounts and web interface user accounts. In distributed solution and multitenancy mode, user accounts are managed on the PCN.

The local administrator account of the application web interface is intended for employees of your organization who need to manage Kaspersky Anti Targeted Attack Platform. When signing in to the application under this account, you will see all sections of the web interface that are available to a user with the Administrator role.

The administrator account of the application web interface lets you manage the application, however, unlike the local administrator account of the application web interface, such accounts are not allowed to manage PCN and SCN servers or tenants in the Operation mode section.

An account with the Security auditor role can view all sections of the web interface available to the local administrator and security personnel. A user with the Security auditor role can view data but cannot edit this data.

The Senior security officer and Security officer roles are intended for employees of your organization whose job description involves managing events and tasks of Kaspersky Anti Targeted Attack Platform. When signing in to the application under accounts with these roles, you will see all sections of the web interface that are available to security officers. Users with the Senior security officer role have access to all operations. The restrictions for users with the Security officer role are listed in the table below.

Access restrictions for application users with the Security officer role

If you are using the distributed solution and multitenancy mode, access to tenants and the web interface of the SCN server can be allowed or denied for each account.