SafeHouse Groups

Nearly all aspects of working with SafeHouse at the administrator level involves the concept of groups. You'll frequently see these groups referred to as "branding groups" because groups' properties are embedded, or branded, into the set of SafeHouse files that you distribute to your user base using a customized SafeHouse Setup program.

Throughout this help guide, the terms SafeHouse group, branding group and administrative group all refer to the same thing.

What is a SafeHouse Group?

Simply stated, a SafeHouse group represents a set of SafeHouse users who are to be managed as a single administrative unit or domain. The number of users belonging to a specific group really doesn't matter since users are never individually known to the group. Group membership for SafeHouse users is determined by which group's properties were branded into the SafeHouse files installed on their PC.

Although it is possible to deploy SafeHouse without using groups, this is extremely rare in corporate environments since the use of groups is required to support SafeHouse's password reset feature -- something that nobody wants to live without.

People who install SafeHouse using the off-the-shelf setup program downloaded directly from SafeHouseSoftware.com do not belong to a group. Groups only begins to make sense when there is a need to distribute the product to a number of people who share a common set of requirements relating to software configuration and corporate policies.

Why have Groups?

When deploying SafeHouse within your organization, you always need at least one group. This holds true whether you're deploying SafeHouse to a single department of 5 to 10 people, or to a global enterprise with thousands of employees.

Whether or not you'll need more than one group comes down to a matter of personal choice. Once you understand more about the characteristics of groups, you'll begin to have a better idea if more than one group makes sense in your environment.

Groups are used to represent sets of SafeHouse users with common interests; and most notably, a common administrator. The most-important property for any given group is its administrator password. By allowing each group to have its own unique administrator password, SafeHouse easily supports kingdoms or domains of users which can be separately managed without the managers of these kingdoms from being able to gain access to any information outside of their own areas.

Some companies choose to deploy SafeHouse using only a single group. Others divide employees up by department or geographic territory.

Using more than one group obviously involves a few more things to keep track of. The trade-off usually comes down to the possible need for isolated security zones or boundaries. How important is it to your company to isolate one group of people from another, to administrate from different support centers, or to carve things up into multiple zones to guard against the possibility of an administrator password being compromised?

Characteristics of SafeHouse Groups

Some of the fundamental characteristics of SafeHouse groups are listed below.

• SafeHouse groups must be created using the SafeHouse Branding Wizard.
• The output from the Branding Wizard is a .BRAND file which is a private-format data file which stores the group's information.
• Each group has its own unique name, serial number and administrator password.
• A single SafeHouse custom Setup program can be associated with at most one group, but you can create multiple Setup programs.
• A group can be associated with any number of customized Setup programs in the event you have multiple deployment scenarios.
• SafeHouse groups can be associated with an administrator account at SafeHouseAdmin.com, which allows for advanced web-based administration of groups and their associated smartcards.
• Group administrator passwords can be saved to SafeHouse-compatible smartcards as plain text.
• Separate from the plain text smartcard features, groups can also be keyed to one or more administrator smartcards which allow sub-level administrators to perform selected tasks without needing to know the group's true administrator password.
• Groups can each have their own localized administrator contact information branded into deployed SafeHouse files and any SafeHouse volumes created from those branded files. This information is displayed in SafeHouse's dialogs.
• Administrators can reset the passwords for SafeHouse volumes; but only for volumes belonging to the group(s) for which the administrator is authorized.

Creating Your First SafeHouse Group

When you're finished creating your group and corresponding .BRAND file, be sure to keep your .BRAND file around; you'll need it when using the Deployment Wizard to create your customized SafeHouse Setup program. This file does not contain any secret information; you don't need to take any special precautions to keep it private.

Click Create a SafeHouse Group to get started with step-by-step instructions.

How to run this wizard:

• To launch this wizard, select the Branding Wizard menu item found in the SafeHouse menu group in your Windows Start menu.