Skip to main content

Groups in NoCode-X.com: Centralized Authorization Management

The Groups feature in NoCode-X.com provides a centralized way to manage authorization across all resources and concepts within the platform. This includes templates (web apps), REST APIs, data formats, and more. By leveraging the Groups concept, developers can effectively implement cybersecurity principles, ensuring secure and fine-grained access control.

Concepts​

The Groups concept in NoCode-X.com is designed to simplify and centralize the management of user access to resources. It allows developers to assign users to groups that represent their functional roles and responsibilities. These groups then determine the level of access users have to specific resources, such as applications, APIs, or data formats.

Key features of the Groups concept:

  • Centralized Management: Manage access control for all resources in one place.
  • Fine-Grained Access Control: Define CRUD (Create, Read, Update, Delete) permissions at the object or concept level.
  • Role-Based Access Control (RBAC): Use functional roles to align access with organizational needs.

Principles​

The Groups concept is built on the following cybersecurity principles:

1. Least Privilege​

Users are granted only the permissions they need to perform their specific tasks.

  • Permissions can be assigned at the object or concept level, such as CRUD operations.
  • Groups allow for fine-grained access control, ensuring users only have access to the resources they require.

2. Need to Know​

Access is controlled based on group memberships.

  • Users are assigned to groups that reflect their functional roles and responsibilities.
  • Group memberships determine what resources and actions a user can access.

3. No Access by Default​

If a group is defined on a resource, users who are not part of any group will have no access to that resource.

  • This ensures that access is explicitly granted and not assumed, reducing the risk of unauthorized access.

4. Fine-Grained Access Control by Design​

Every resource in the NoCode-X.com ecosystem is designed to support fine-grained access control.

  • Developers can configure access control for each resource out of the box.
  • This centralized approach simplifies the management of authorization across the platform.

Why Use Groups?​

The Groups concept helps developers and organizations:

  • Enhance Security: By adhering to principles like least privilege and no access by default, the system ensures robust cybersecurity practices.
  • Simplify Management: Centralized and role-based access control reduces the complexity of managing permissions across multiple resources.
  • Improve Transparency: Functional groups make it easier for both technical and business users to understand and manage access.
  • Align with Organizational Roles: Using functional roles ensures that access control aligns with the organization's structure and needs, avoiding overly technical and complex authorization schemes.

Contribution to Security Standards​

ISO 27001:2022​

The Groups concept in NoCode-X.com contributes to the implementation of key requirements in ISO 27001:2022, including:

  • Clause 5.2 (Policy): Supports the establishment of an information security policy by enabling centralized and fine-grained access control.
  • Clause 5.3 (Roles and Responsibilities): Ensures that roles and responsibilities for access control are clearly defined and managed.
  • Clause 6.1.2 (Risk Assessment): Helps mitigate risks by enforcing least privilege and need-to-know principles.
  • Annex A.9.1.2 (Access Control Policy): Implements a centralized access control policy for all resources.
  • Annex A.9.2.3 (Management of Privileged Access Rights): Ensures that privileged access is managed and restricted to authorized users.

NIST-53 CSF​

The Groups concept aligns with the following NIST-53 CSF controls:

  • AC-2 (Account Management): Manages user access through group memberships.
  • AC-3 (Access Enforcement): Enforces access control policies at a fine-grained level.
  • AC-6 (Least Privilege): Ensures users only have access to what they need.
  • AC-5 (Separation of Duties): Supports separation of duties by assigning specific roles to groups.

Cyber Fundamentals Essentials​

The Groups concept supports the Cyber Fundamentals Essentials framework by:

  • PR.AC-4 (Access Permissions and Authorizations): Incorporates least privilege and separation of duties into access control.
  • PR.AC-1 (Identity and Credential Management): Ensures that access is tied to group memberships and managed centrally.
  • ID.GV-1 (Cybersecurity Policy): Aligns with organizational cybersecurity policies by providing a centralized mechanism for managing access.
  • ID.AM-6 (Roles and Responsibilities): Establishes clear roles and responsibilities for access control.

Summary​

The Groups feature in NoCode-X.com is a powerful tool for managing authorization across the platform. By using functional groups that align with organizational roles, developers can:

  • Implement fine-grained access control.
  • Ensure clarity and transparency in access management.
  • Simplify the oversight of who can access what.
  • Strengthen cybersecurity by adhering to principles like least privilege and no access by default.

By design, NoCode-X.com provides developers with the tools to centrally manage authorization, making it easier to build secure and scalable applications while aligning with international security standards like ISO 27001:2022, NIST-53 CSF, and Cyber Fundamentals Essentials.