Manage Security Settings

The Manage Security Settings page allows an administrator or user with Edit Settings access permission to set certain security features for their company.

The Manage Security Settings page is shown below.

Password Policy

In this section, a user with access to this page can change the password complexity rules (e.g. length, must contain numbers, letters symbol), turn password aging on/off and set the time interval for requiring a user to change their password after a certain period of time.

The Password-Aging feature allows the administrator to force users to change their password after a defined number of days. User passwords will never expire if this value is set to 0.

When changes are made to the password complexity rules, those changes are not reflected for a user until the user is required to change their password. For example, if the password length has changed from 8 to 12, this rule will not be enforced until the next time the user changes their password. Even though their current password is only 8 characters in length, it will still be valid for them to sign on. An administrator can force all users to use the new password rules by checking the option 'Force all user to change password at next sign in.'

IP Address Management

In this section, a user with access to this page can identify the IP addresses that are allowed to access the CMS. The IP addresses can be managed by clicking on the appropriate button, 'Add IP Address' or 'Edit/Show IP Address'. These buttons are accessible when the 'Restrict Access to CMS Via IP Address ' feature is enabled (checked) on the Settings page. The 'Edit/Show IP Address' button is enabled when IP addresses have been previously added. Enabling the 'Check Previous IP At Sign in' will send an email notification to a user if their current IP address differs from the previous IP address used to sign on successfully.

Email Link Management

In this section, a user with access to this page can set a specific expiration periods for certain email links sent to a user via the CMS.

New User Password Link Expiration (hrs):

This value represents the number of hours before the link sent in the 'Welcome' email message expires.

Forgot Password Link Expiration (hrs):

This value represents the number of hours before the link sent in the 'Forgot Password' email message expires.

Two-factor PIN Link Expiration (hrs):

This value represents the number of hours before the link sent in the 'Two-factor PIN' email message expires.

Session Management

In this section, a user with access to this page can set a specific timeout warning and timeout session limit for their company's access to the CMS.

Session Timeout

This value represents the number of minutes of idle time before a user's CMS session times out. The user will receive a message that the session has timed out and the user will be automatically signed out of CMS and their unsaved input will be lost. Idle time is considered to be the time between consecutive interactions with the CMS server (e.g., a page refresh, moving to another CMS page, however typing in the CMS without changing pages is not considered an interaction).

Session Timeout Warning

This value represents the number of minutes before a session times out that a user receives a warning message. The user can click 'OK' on the warning message to continue their session (reset idle time to 0). For example, if this value is set to 5 minutes, a warning message will be presented to an idle user 5 minutes before their session times out.

Web API Access

In this section, a user with access to this page can enable the Web API access to the CMS and create the Web API credentials. This feature is available to clients at the Enterprise Service Level.

Enable

This options allows the administrator to enable the Web API access to their CMS. When the Web API Access is enabled, the CMS will allow remote transactions to query and add incident reports given proper credentials. When this option is not enabled all Web API requests will be rejected. There is a limit of 100 Web API transactions per day. To learn more about the Web API Access into the CMS, please see the Lighthouse document entitled "CMS Web API Specifications."

Web API Key

This value is used along with the Web API password to act as credentials that are required on the Web API Access into the CMS. This value is generated internally by the CMS. A new value can be generated by clicking the 'Generate Web API Key' button.

Web API Password

This value is used along with the Web API Key to act as credentials that are required on the Web API Access into the CMS. The admin creates the Web API password. To change the Web API password, click on the 'Reset Password' and then enter a new password and click the 'Save' button.