Report Security & Access Control

Why Report Security Matters

Reports contain sensitive business data (revenue, salaries, customer info) that must be protected.

Security Risks

• Data Leakage: Sales rep sees competitor pricing (shouldn't have access)
• Compliance Violations: GDPR/CCPA - unauthorized access to personal data (fines up to €20M)
• Competitive Intelligence: Employee downloads customer list before leaving company (IP theft)
• Privacy: HR report shows salaries (only HR should see, not entire company)

Security Layers

Layer 1: User Authentication

• Login Required: Must authenticate before accessing any reports
• SSO Integration: Active Directory, LDAP, SAML (corporate credentials)
• Session Timeout: 30-min inactivity → Auto-logout (prevent unauthorized access)

Layer 2: Role-Based Access

• Roles: Sales Rep, Sales Manager, Sales VP, Admin
• Permissions: Each role has specific report access
  • Sales Rep: My Pipeline, My Activities
  • Sales Manager: Team Pipeline, Team Activities, Rep Performance
  • Sales VP: Company Pipeline, Revenue Dashboard, Win Rate Trends
  • Admin: All Reports + User Management
• Least Privilege: Grant minimum access needed (rep doesn't need company-wide data)

Layer 3: Row-Level Security

Users see only data they're authorized to view (even within same report).

Layer 4: Column-Level Security

• Scenario: Opportunity report shows Revenue, Cost, Margin
• Sales Rep: Sees Revenue only (Cost, Margin columns hidden)
• Sales Manager: Sees Revenue, Margin (Cost hidden)
• Finance: Sees all columns (Revenue, Cost, Margin)

Configuring Report Security

Step 1: Define Security Roles

1. Navigate to Administration → Security → Roles
2. Create role: "Sales Manager"
3. Set permissions:
   • Can run: Team reports
   • Can create: Custom reports (on own data)
   • Can share: Reports with team members
   • Cannot: Delete system reports, Access admin reports

Step 2: Assign Users to Roles

• User: John Smith
• Role: Sales Manager
• Territory: Northeast
• Result: John sees only Northeast data in team reports

Step 3: Configure Row-Level Security

Report: Opportunity Pipeline
Security Filter:
  IF User.Role = "Sales Rep" THEN
    WHERE Opportunity.Owner = CurrentUser.Id
  ELSE IF User.Role = "Sales Manager" THEN
    WHERE Opportunity.Owner IN (CurrentUser.TeamMembers)
  ELSE IF User.Role = "Sales VP" THEN
    -- No filter, see all data
                    

Step 4: Configure Column Visibility

• Revenue Column: Visible to: All Users
• Cost Column: Visible to: Finance, Executives (hidden from Sales)
• Margin Column: Visible to: Sales Manager, Finance, Executives
• Commission Column: Visible to: Owner only (each rep sees own commission, not others')

Report Sharing Controls

Sharing Levels

• Private: Only creator can view (default for new custom reports)
• Team: Creator + team members (share with Northeast sales team)
• Department: All Sales users (company-wide department access)
• Public: All authenticated users (company-wide, use sparingly)
• Specific Users: Choose individuals (share with VP + 2 directors)

Sharing Workflow

1. User creates custom report "My Custom Pipeline Analysis"
2. Initially: Private (only creator sees it)
3. Click Share button
4. Select: "Share with Team" (5 team members)
5. Set permissions:
   • Can View: Yes (team members can run report)
   • Can Edit: No (only creator can modify definition)
   • Can Share: No (team members can't reshare)
6. Team members see report in "Shared with Me" folder

Data Masking & Redaction

Sensitive Field Masking

• SSN: Display "***-**-1234" (last 4 digits only)
• Credit Card: Display "****-****-****-5678"
• Email: Display "j***@company.com" (partial masking)
• Salary: Display "$XX,XXX" (only HR sees actual $85,000)

Dynamic Masking

Example: Contact Phone Number

• Account Owner: Sees full number "555-123-4567" (needs to call customer)
• Other Sales Reps: See masked "555-***-****" (shouldn't poach accounts)
• Finance: See masked (don't need customer contact info)
• Implementation: Database function masks data based on user context

Audit Logging

What to Log

• Report Execution: User, Report Name, Timestamp, Parameters
• Data Exports: User downloaded 10,000 contacts to CSV (audit trail)
• Report Sharing: User A shared report with User B (who has access)
• Failed Access: User tried to access restricted report (security breach attempt)
• Data Changes: User modified report definition (version history)

Audit Report Example

Alert: Jane Doe tried to access Executive Dashboard (not authorized) → Notify security admin

Compliance Requirements

GDPR (EU Regulations)

• Right to Access: Customers can request all data stored about them → Generate report of customer's data
• Right to Erasure: Customer requests deletion → Reports exclude deleted customer data
• Data Minimization: Only collect/report necessary data (don't include personal data if not needed)
• Consent Tracking: Report shows which customers consented to marketing (compliance check)

CCPA (California Regulations)

• Disclosure: Report must show what personal data is collected (transparency)
• Opt-Out: Customers can opt-out of data sale → Reports flag opted-out customers

SOX (Financial Regulations)

• Audit Trail: All revenue reports must have audit log (who ran, when, what data)
• Segregation of Duties: Finance creates reports, but IT approves (no single point of control)
• Data Integrity: Reports must match source data (validation checks)

Best Practices

• Regular Access Review: Quarterly audit - remove access for departed employees, reassign reports
• Minimal Exposure: Default to Private (user explicitly shares if needed)
• Monitor Exports: Alert if user exports > 10,000 rows (unusual activity)
• Watermarking: Add "Confidential - John Smith - Nov 5, 2025" footer to PDFs (track leaks)
• Training: Educate users on data handling (don't email sensitive reports to personal email)
• Encrypt Exports: Password-protect Excel files (prevent unauthorized access if file shared)
• Retention Policies: Auto-delete audit logs after 7 years (compliance + storage management)
• Incident Response: If breach detected (unauthorized access) → Immediate alert to security team, lock user account

Example: HR Salary Report Security