WEBVTT

00:02.400 --> 00:05.360
Thank you for your interest in learning
more about the Veeva Vault

00:05.360 --> 00:09.680
platform, the most prominent platform
in the life sciences industry.

00:09.840 --> 00:13.800
In this session, you will get an overview
of how application security

00:13.840 --> 00:15.320
works in Vault.

00:15.320 --> 00:19.480
The Vault application
security is divided into two categories.

00:19.800 --> 00:23.360
First, functional security,
which is how permissions,

00:23.360 --> 00:27.080
features and functions
that users have access to are controlled.

00:27.480 --> 00:32.320
Second, data and document security,
which is how visibility to data records

00:32.320 --> 00:37.240
or documents is controlled, which goes
down to the field level or value level.

00:38.320 --> 00:41.480
A users access to functions
in Vault is defined

00:41.480 --> 00:45.240
by their security profile,
which is a collection of permissions

00:45.240 --> 00:48.680
describing what capabilities
they may perform within Vault.

00:48.800 --> 00:52.800
Every user has one profile
which contain one or more

00:52.800 --> 00:56.880
permissions sets that define access
to areas of functionality.

00:56.920 --> 01:01.160
For example, a permissions set defines
what tabs a user sees

01:01.160 --> 01:02.520
and what objects they have.

01:02.520 --> 01:06.440
Create, read,
update, and delete access to.

01:06.560 --> 01:09.720
These also include controlling
administration permissions

01:09.720 --> 01:12.960
such as modifying and migrating
configuration.

01:13.280 --> 01:16.600
Users can also be a member of one
or more groups.

01:16.760 --> 01:20.960
A group is simply a named list of users,
but by defining groups

01:20.960 --> 01:25.200
that reflect the teams and roles
in your company and assigning those groups

01:25.200 --> 01:29.720
to object or document roles,
you can manage access more efficiently.

01:30.720 --> 01:34.040
Application roles and sharing settings
give access

01:34.040 --> 01:37.880
to certain permissions
on individual object records or documents.

01:38.040 --> 01:40.120
The permissions
assigned to the application

01:40.120 --> 01:44.000
role defines what the users in that role
can do to the record.

01:44.160 --> 01:45.920
Users and groups can be assigned

01:45.920 --> 01:49.680
different relationships
to a record or document based on criteria.

01:49.680 --> 01:52.320
In order
to automate these role assignments.

01:52.320 --> 01:55.320
For example,
an object record can be visible

01:55.320 --> 01:58.360
based on an assigned role of viewer
or editor,

01:58.360 --> 02:02.640
and conditions can be established
when those roles are effective or not.

02:02.760 --> 02:08.280
This allows visibility rules to be managed
at both the group and user level.

02:08.440 --> 02:09.400
Any changes

02:09.400 --> 02:14.000
to security settings at a group level
cascade down to the users in that group-

02:14.000 --> 02:19.160
streamlining security updates. The system
assigned  permissions allow automation,

02:19.160 --> 02:22.640
but also leaves flexibility
for managing exceptions.

02:22.920 --> 02:27.120
Sharing settings are visible
in a section on the record, and it shows

02:27.120 --> 02:31.080
which users or groups are assigned
and in which role capacity.

02:31.200 --> 02:35.440
For instance, you can see that
Frank is in the owner role on the object

02:35.440 --> 02:39.360
sharing settings shown here,
while the all internal users group is

02:39.360 --> 02:40.560
in a viewer role.

02:41.520 --> 02:44.840
Dynamic Access Control, or DAC for short,

02:44.880 --> 02:49.400
offers a flexible model for assigning
record level access for an object.

02:49.560 --> 02:53.720
DAC can automatically grant record
level access via user data,

02:53.720 --> 02:57.960
such as granting country level records
to all users within that country.

02:58.000 --> 03:01.720
Records can also be shared
dynamically based on record fields,

03:01.720 --> 03:03.720
which may change over time.

03:03.720 --> 03:06.960
For example,
a user may be able to edit a record

03:06.960 --> 03:10.000
until a certain status,
for example “Submitted”

03:10.040 --> 03:13.840
Then the record becomes locked
from further edits, or the record

03:13.840 --> 03:17.240
can become hidden when the record reaches
an archived status.

03:17.600 --> 03:22.280
Sharing rules provide the flexibility
to use vast combinations of criteria

03:22.280 --> 03:26.280
that your organization defines
in order to grant the appropriate record

03:26.280 --> 03:31.240
or document access to users
based on any of the fields or values.

03:32.200 --> 03:34.160
Finishing up with atomic security

03:34.160 --> 03:39.040
for objects or documents,
you can secure fields, actions, controls,

03:39.040 --> 03:42.080
and relationships
by individual lifecycle states

03:42.080 --> 03:46.080
or assigned roles on an object,
record, or document.

03:46.160 --> 03:50.840
This grants permissions on specific
fields, actions, or relationships

03:50.840 --> 03:54.360
based on user roles on the record
and state of the record.

03:54.560 --> 03:58.840
Permissions can be configured
for each rule and state combination,

03:59.000 --> 04:02.400
but this is best shown from the end user
perspective.

04:02.640 --> 04:04.720
Let's walk through an example.

04:04.720 --> 04:08.240
A user creates
a record and has access to all fields

04:08.240 --> 04:11.680
and actions granted by the permission
sets in their profile,

04:11.720 --> 04:15.760
but when the record is submitted,
the user access changes.

04:15.840 --> 04:19.800
This same user now has a read
only view of the entire record,

04:19.800 --> 04:23.920
except for a comments field,
which is granted by Atomic Security,

04:23.920 --> 04:28.600
and when the record is approved,
the field level security is changed

04:28.600 --> 04:33.240
based on the record status and locked
the comments field from future edits.

04:33.480 --> 04:38.640
As you can see, the application security
controls in Vault are extremely powerful.

04:38.760 --> 04:41.960
More robust
security is an example of how the Vault

04:41.960 --> 04:45.360
platform
is built for the life sciences industry.

04:45.960 --> 04:50.960
If you want to learn more about Vault,
please contact your Veeva account partner.