Roles and separation of duties
Four roles in a ladder, three jobs beside it, and the duties kept apart.
| Role | May |
|---|---|
viewer | read findings, cases, the vulnerability queue and the dashboards |
analyst | triage findings, open cases and add notes to them, hunt through events |
responder | run cases, ask for an action on another platform, approve somebody else's action, accept a risk |
admin | manage people, connectors and their credentials, and settings |
Each role includes the ones before it. Beside the ladder are jobs, granted for a set time: an engineer tunes detections and automation rules, a vuln-manager decides vulnerabilities, and an auditor reads the queue and the audit log. A job is granted for a set time, and the grant ends by itself. vaigil auth roles prints the whole model.
Duties kept apart
- An action on another platform is approved by somebody other than whoever asked.
- Whoever wrote an automation rule does not approve the runs it holds.
- Making somebody an administrator, issuing an administrator's token, weakening a setting, lowering how many approvals a change needs and moving the audit log each take a second administrator.