In many teams "the dashboard" is the login of whoever signed the contract, with the password in a shared vault. That works until something goes wrong: you cannot see who did what, everyone needs a new password when someone leaves, and the engineer who only wants to look at a DDoS attack sees every invoice as well. Our customer dashboard therefore works with a login per person and rights per section. This article shows how to set that up.
A contact and a user are two things
Account → Contacts lists who we reach. Every contact has one or more roles:
- General — the point of contact for your account.
- Billing — receives invoices and payment reminders.
- NOC / technical — receives notices about maintenance and outages, and the notifications during a DDoS attack. Preferably give a number that is reachable 24/7; this is who we call when something needs to happen right away.
If a role has nobody yet, the list says so. A contact does not need to be able to log in. The bookkeeper who receives invoices may never have a reason to open the dashboard; the network engineer who gets called at night does.
Inviting a colleague
Next to every contact is a button to invite them as a user. You choose a role:
- User — may only do what you tick.
- Co-owner — may do everything, including inviting other users and changing payment details.
The colleague receives an e-mail with a link to choose a password. The link is valid for seven days and works once. The contacts list shows per person whether they are no user, invited or an active user. Once logged in, everyone can add a passkeyPasskey Signing in with a cryptographic key on your device instead of a password. Phishing-resistant, because the key only works on the real website. in their profile, so no password is needed any more.
Which rights there are
The rights follow the dashboard menu:
- Billing — viewing and paying invoices, billing settings and credit cards.
- View network — network links, traffic, DDoS, subnets, IP addresses and prefix lists.
- Manage network — approving prefix lists, managing IP addresses and blackholes, declaring subnets and setting up DDoS notifications.
- Colocation — racks, shared colocation and data centre registrations.
- Backups and Object storage — snapshots, buckets and access credentials.
- Contacts — adding and changing contacts.
The distinction that matters most is between viewing and managing the network. Your NOCNOC Network Operations Centre: monitors the availability and operation of networks and responds to outages. Not the same as a SOC. colleague needs to see what is happening during an attack; whether they can also approve a prefix list or blackhole an address is a different decision. A blackhole makes an address unreachable, and an approved prefix list ends up on our routers. Give those rights to the people who are also responsible for them.
What someone may not do, they do not see either: the menu only shows the sections that open for that user. Nobody clicks a link that ends in an error.
Why only the owner invites
The Contacts right lets someone manage contacts, but not invite them as users. That seems strict, but it prevents a classic leak: whoever may create users and choose their rights can give themselves or someone else more than they have. Inviting users is therefore reserved for the owner and co-owners.
That is also what the Cyber Security Act means by access management: an account of your own for everyone, rights according to what someone needs, and a clear answer to the question of who granted those rights.
When a colleague leaves
A login per person makes a departure simple: only that one access is closed, and nobody else needs a new password. When someone leaves, let us know; we disable the user and they can no longer log in straight away. Remove them as a contact too if they still receive notices, so that during an outage nobody gets called who no longer works there.
The dashboard at Xyphen IT
Every customer with IP transit, colocation or other services on our network gets access to the dashboard. What you do with each section is covered in the articles on following a DDoS attack and on your rack from a distance. Questions about access for your team? Get in touch.