Banner Security for Human Resources

1
Banner Security for Human Resources
Middle East Users Group 2006
SGHE 2006 Platinum Sponsors
2
Agenda

• BANSECR Security
• Application Security
• VBS
• PII

3
BANSECR Initial Setup

• Every person must be given access to the database
• ID is established
• Password is established
• At this point, a person can sign onto Banner, but
  cannot get past sign-on screen

4
BANSECR Major categories

• Objects
• Classes
• Profiles

5
OBJECTS

• Forms
• PEAEMPL
• Jobs
• PHPTIME
• Menus
• We dont see most of them but they are
  essential
• NOQMENU, POQMENU, GUAGMNU

6
OBJECTS (cont)

• For each object, decide if Access Maintenance (M)
  or Query (Q) for each class
• For some Inquiry (PHI and NBI) forms, must give M
  access to work
• Does not allow true modification, but only the
  ability to change parameters such as dates
• OK to give to all Inquiry forms
• Job Submission will not work without maintenance
  access to GJAPCTL and GUQINTF as well as specific
  job
• Dont forget system file forms
• GUACALN, GUACALC, GUAHELP, GUAPARM

7
Classes

• Objects are combined into classes
• Classes are groups of highly related objects that
  make sense to provide access to as a group
• Objects can and will appear in multiple classes
• Classes are attached to individuals

8
Profiles (Roles)

• Combinations of classes that relate to business
  needs as practiced at a particular institution
• May be department based
• May be based on specific work function
• Are not actually entered into Banner
• Defined by Institutional Needs

9

• Although BANSECR Security is now complete, and
  the employee will be able to enter Banner they
  will not yet be able to see or do anything!

10
Application Security - PTRINST

• One Time Set-up
• Sets forth types of security to be used at
  Institution
• Employer
• Organization
• Employee Class
• Salary
• Any or all of the types of security may be used

11
PTRINST

• If any or all of these boxes are not checked,
  that type of security is not implemented at the
  institution
• Entering data in the rest of the security forms
  will not limit access if a type of security is
  not being used

12
Refining Security

• PSAEMPR
• Employer Security
• PSAORGN
• Organization Security
• PSAECLS
• Employee Class Security
• If Employee has e-class and Organizational
  Security, will see only the e-classes within the
  organization

13
Application Security - PTRUSER

• Established Master Level Security for Employer,
  Employee-Class and Organization
• Establishes Salary Level if Salary Security Used
• Establishes Benefits Administrator
• All employees with on-line access must be entered
  here
• Establishes Timekeep Superuser
• Works only within Organizational Security
  Parameters

14
Application Security

• If Master Security for any of these categories
  is checked on PTRUSER, the Employee will be able
  to see everything within that security category
  overriding anything that appears on this form!!

15
Application Security

• If Master Security for any of these categories
  is NOT checked on PTRUSER, the Employee will not
  be able to see anything until the appropriate PSA
  Form is completed.

16

• Value Based Security
• Additional Choices in Banner 7.1 and later

17
Value Based Security

• VBS uses Oracles Fined Grained Access Control
  (FGAC)
• Benefits
• Can be used by any Banner Product
• Controls Select, Insert, Update, and Delete
• Addresses row-level security throughout Banner
• Is a LOT of work to maintain

18
VBS An Address example

• Example of VBS Restrict access to addresses by
  address type.
• Create a VBS rule where staff in the Admissions,
  Registration, Student Billing and the Deans
  offices can insert, update and delete addresses
  if the type is Mailing, Permanent or Parents.
  The staff in Payroll and Central Accounting can
  maintain addresses only if its a W2 or Permanent
  type.
• All users can select an address for viewing.

19
PIIPersonally Identifiable Information
20
Personally Identifiable Information (PPI)

• Security is to restrict a person for viewing ID
  information to just the subjects in their
  functional processing area.
• VBS and PII use the same technology, Oracle Fine
  Grained Access Control (FGAC).
• VBS restrictions are coded as needed for
  individual users.
• PII is implemented system wide. All users of the
  system are restricted by PII except when
  specially exempted.

21
Summary

• Security requires cooperation between technical
  and central user staff.
• Understanding a bit of what happens in BANSECR
  assists in providing technical staff with the
  information they need to do what the users need.
• The system has great flexibility if used to its
  best advantage and can be customized to the
• levels required at each institution

22
Questions and Answers

• Any questions?
• ? ? ? ? ? ? ?

23
(No Transcript)