Heritage Security
Heritage is a single application with its own security environment in addition to any network security that is used to control overall access to software. There is a single login required which controls access to all Heritage modules.
System security within Heritage is provided in the form of password protection. Password control is tiered in Heritage, giving access only to those individuals pre-determined by the Library staff. Any number of access privileges can be created for any individual member of staff, or groups of members (e.g. IT specialists, Learning Resource Managers etc).
Heritage will only enable those members of staff with the appropriate security level to modify system settings, information and borrower records. Different configurations of the following privileges can be set: search, read, create, update and delete. There are also some additional controls in various areas of the system (e.g. different budgets can be restricted for the view/use of specified members of staff in the Acquisitions module).
In general, library users will have ‘guest’ status, which gives them access to the Heritage Enquiry menu only, although this is configurable and libraries operating a self-issue system would also make the ‘Issue’ option available. No other modules would be visible to ‘guest’ level users – they do not even see the menu options they are prevented from accessing.
The only time a ‘guest’ level user would require a PIN or password is if they want to access their own Reader Information screens. Heritage can automatically generate and email PINs to users if necessary.
Heritage installs to a single directory with a number of subdirectory. Access to Heritage and its files can be set using standard file sharing security methods. Details of what access users will require and to which files is given in the installation instructions supplied with the software.
Data is not encrypted within Heritage with the exception of passwords. Passwords are passed to Heritage Online using plain text unless SSL is used.
Users outside of the library are expected to use Heritage Online with security being applied primarily by IIS or third party software.
Communication between Heritage Online and the DataServer is encrypted using RC4 with MD5 signatures.