Security

Previous Next 1 2 3 4 5 6 7 8 9 10

Security means different things to different users. For some, it might mean hiding their assets from preying eyes or even those within the organization who doesn't have the proper authorization to certain part of the source code; for some, it might mean that all changes made to the source code pass through appropriate approval process; yet for others, it might mean that preventing viruses and malicious attacks from their assets. For Firefly, security means all of these things, and more.

Firefly implements a N-tier structure and therefore does not require any shared file system. As a result, the back-end repository is transparent to the client. This greatly reduces the risk of virus infection and being attacked by malicious developer or someone who stole their credentials.

Firefly has built-in SSL support in both web UI and client GUI.  SSL stands for Secure Sockets Layer (SSL V3.0), which is a security protocol that provides communications privacy over the Internet.

Firefly uses ACL to implement access control. Administrator can specify which object can be accessed by whom, user or group. A user group can be defined by the administrator. This is a convenient way to define ACL and saves a lot of energy by allowing project manager to set privileges on a group instead of on each individual. And if necessary, each user can have access rights that are different than that of the group they belong to.

Authorization in Firefly is double-layered. The first is the branch ACL. Each branch can be set to allow certain user or user group to execute certain or all operations on it. Such operations include bringover, submit, create label, create sub-branch and so on.

And file/folder level access control is the other frontier. This level of access control is much like that of NTFS'. You can set ACL for a folder and all sub-directories and files by default will inherits the ACL setting from their parent folder. You can set individual files/folders to allow access by certain user/group.

Click here to enlarge

In Firefly, user can set different ACL for the same file basing on branches. For example, Main.java might be accessible to Tom on Dev stream, but that same file won't even be seen by Tom on Integration stream.

Firefly also supports process approval. All changeset can be set to pending approval before they are allowed to merge back to the stream. Project manager or an auditor can then review each change to make sure they are genuine and do not contain malicious or copyrighted content.

Previous Next 1 2 3 4 5 6 7 8 9 10