Overview
This article differs slightly from the other Trail Blazer “Best Practices” articles as these have no schedule associated with them.
Ideally, user security should be reviewed on a regular basis. How often you do that or what do to during a user security review is part of the “Regular Maintenance Best Practices” article. As such, reviewing user security will not be presented here.
This article presents suggestions what to do when setting up Trail Blazer users. This link explains how to set up users and configure their security settings.
Security Management Write Access
Our first recommendation is that at least one or two people in your organization have the ability to view (read) and modify (write) security settings. The red outlined area in the picture below shows where inside the Admin tab à Attributes sub-tab these two security settings are located.
Trail Blazer recommends at least one person within your organization has authorization to grant Trail Blazer access (Allow Write Access in the picture above) and security attributes to others in your organization.
This person(s) would manage and maintain security on an ongoing basis for your organization. We call the role this person(s) fill as a “Trail Blazer Administrator”.
Why does Trail Blazer recommend having a Trail Blazer Administrator in your organization? The answer is so your organization has complete control over who has access to specific areas inside Trail Blazer. As a company external to your organization, Trail Blazer Campaign Services does not know who are people associated with your organization nor what level of access is appropriate for various persons in your organization. That knowledge resides completely within the people in your organization. As such, your organization is in a much better position to manage user security to your Trail Blazer database than Trail Blazer Campaign Services.
Also note that having “Security Management” access in Trail Blazer means the user can access the System Manager folder of the Application Menu.
Be careful of how many people you grant this level of access. Ask yourself: “Does everybody in your organization need to create and maintain other users and their security attributes?”
Appropriate Security Attributes
That leads into a discussion about other security attributes and their appropriateness for users. Before you set up a new user, decide what security attributes best match the role that new user has with the organization.
The best approach for this is to go down the list of Trail Blazer security attributes. For each security attribute, ask yourself: “Does <new user’s name> need <security attribute, including path to that security attribute> as <role they fill in the organization>?” where:
· <new user’s name>replace with the person’s name.
· <security attribute, including path to that security attribute> replace with the security attribute and the path name to that attribute rewritten to make sense in the context of this sentence.
· <role they fill in the organization> replace with the role they are performing for your organization.
Some examples of this questions method are:
· Does Tom Schunkle need notification by email (notify) on event signup as the Treasurer?
· Does Dan Veeheeman need allow write access to calendar(s) as a data entry person?
· Does Jim Glibsen need read access to contributions as a campaign manager?
· Does Mark Prangler need allow add/edit of attributes as a field canvasser?
· Does Pat Harnf need read data access of Voter (or donor or contact) as a precinct captain?
· Does Sue Siddila need the ability to send mass email as the receptionist?
Take a look at those examples and see if you can match them to the security attribute settings in this link. If you didn’t find all of them, take a second look at the question and in that link’s section called “List of Email Notification and Security (Attribute) Settings”.
Security Attributes Needing Special Consideration
There are several security attributes that need careful consideration of whom you grant access to. They follow along with a short explanation why you should be careful when allowing access to them:
· Security/Applications/Email/Activities/Allow Sending of Individual Email: This is a send-one-email-at-a-time email setting. Any mail sent from Trail Blazer will be marked as being sent from the user’s email address that you set up in their voter record. Does this person need to communicate with your voters/donors using the database?
· Security/Applications/Email/Activities/Allow Sending of Mass Email: This is the same as above, but they can send email to any or all of the people in your Trail Blazer database.
· Security/Applications/Security Management/Data/Allow Read Access: Having this security attribute set allows someone to see (but not change) the user login information for any voter in Trail Blazer and see any information in the Application Menu / System Manager. A deeper discussion of this topic was presented in the previous section of this article.
· Security/Applications/Security Management/Data/Allow Write Access: Having this security attribute set allows someone to change user login information for any voter in Trail Blazer and change any information in the Application Menu / System Manager. A deeper discussion of this topic was presented in the previous section of this article.
· Security/Applications/Global/Activities/Allow Data Export: This enables a person to take your Trail Blazer data and export it to a file (or files) outside of Trail Blazer. A person who routinely sends lists of names and addresses your mail house would need this setting. So also would the person who is managing data appends where the data is sent to an external vendor for NCOA, Phone Append, or other appends.
· Security/Applications/Global/Activities/Allow Data Import: This setting allows someone to take a structured text file and import it into your organization’s Trail Blazer database. Your existing data may be modified by the incoming file’s data. This activity can corrupt your Trail Blazer data if done improperly. Obviously, this is a powerful security attribute. Setting it for a user needs careful consideration before doing so.
· Security/Applications/Global/Activities/Allow Mass Updates: This will allow users to set one column to a value for all the items inside a search window’s list of retrieved records.
Gotcha! Restricting Enter/View Financial Data
Do you want to restrict (or grant) access to someone so they can enter or view financial data? Be careful when you go to configure this for your user. Why? Because there are two places in the security attributes that need to be set. This is illustrated by items #1 and #2 in the picture below.
#1 in the picture refers to accessing the Financial area of Trail Blazer. This is where you enter invoices, payments, loans, bank accounts, deposits, and account transfers. Note: except for deposits, this is an area rarely used by Trail Blazer’s non-profit customers.
#2 in the picture refers to contributions (or donations) made by voters (or donors or contacts) to your organization.
Distribution of User IDs and Passwords
With your license of Trail Blazer, you are allowed to define an unlimited number of Trail Blazer users. That said, why would you want people to share Trail Blazer IDs and passwords? Allowing that to occur raises the possibility that those user IDs and passwords could be compromised by unauthorized people discovering the user IDs and passwords.
Also keep in mind that Trail Blazer associates updates, deletes, and new records with the user that created them. This is to determine from any future date the user that created or changed or deleted information in the database. By having people “share” the same user ID and password, Trail Blazer can no longer identify one single person as having performed an action on the data.
The points raised in the three preceding paragraphs lead us at Trail Blazer to strongly advise that each and every person that will use Trail Blazer be given their own login ID and password with appropriate security access levels set.
One exception to this rule would be a large population of volunteers whose access will be through the mobile canvassing application. In this case it may be prudent to share login id as they will not be directly accessing the database through the desktop application.
Receiving Email Notification on Web Interaction
Do you want the user to receive email notifications when someone enters data into a Trail Blazer IFRAME that is embedded inside your website? Two steps need to be done:
1. Set the appropriate Security Attributes.
2. Configure the Signup Notification administrative settings.
Setting the appropriate Security attributes is talked about and shown in this link. The Security Attribute folder is Notification by Email àWeb Services.
To configure the Signup Notification administrative settings, go into the Settings sub-tab of the user’s Admin tab. Enter the email address to receive the email notifications to be sent to. This is illustrated in the picture below.
Restricting Access to a Subset of Data
There is a way to limit which Voters (Donors / Contacts) a user can search, look at, and change. This is done via the Filter sub-tab of the user’s Admin tab. A sample of this window is shown below.
Clicking the Apply Database Filter allows you access to enter the criteria of the data you wish the user to access. You can restrict access by: state, city, county name, CD (congressional District), SD (state senate district), LD (state legislative district – lower house of state legislature), ward, precinct code, precinct name, or by a saved voter favorite. All of the items other than the voter favorite are able to handle multiple items. For instance, if I wanted a user to only access voters in the cities of Paynesville or Hopkins, I would enter it as this:
Entering items on more than one line serves as combining the items to make a more restrictive view of the data. For example, look at the following picture.
What this would restrict this user’s access to voters in the database who: live in MN and also live in either the cities of Paynesville or Eden Valley and also reside in Stearns county.
It was mentioned that you can also restrict a user’s access by a voter favorite. What this means is that you first create a favorite in the voter search window (this linkshows you how). Then inside the Filter sub-tab of the user’s Admin tab you select the name of the voter favorite. An example of this is shown in the window below.
In the example of the picture above, I’ve created a voter favorite query that searches for voters in the database that: live in MN and also live in either the cities of Paynesville or Eden Valley and also reside in Stearns county. This is another way to create the previous example where I entered the criteria into the State, City, and County fields.
When you have the ability to use either of the two methods presented, which is preferred? We recommend when possible to limit by the state, city, county/parish name, CD, SD, LD, ward, precinct code, and precinct name. It is clearer to understand by looking at the user’s Filter sub-tab entries what the user is allowed to access. Also, voter favorites can be modified or deleted over time – potentially changing the data the user may access.
Do you need assistance with any of the topics presented or on any other subjects?
Call our toll-free support line at (866) 909-8700 or (952) 767-2651 if local.
If you wish, you can email our support team at: support@trailblz.com.
