On-Line RFP

00) RFP Response Introduction

Darian — Fri, 29 Jul 2011 14:47:07 GMT

Current revision posted to On-Line RFP by Darian on 7/29/2011 10:47:07 AM

00) RFP Response Introduction

Aras Corporation is pleased to provide a response to an RFP/RFQ for a Product Lifecycle Management Solution. As you will see by the enclosed information, Aras is uniquely qualified to meet the complete requirements of XXXXXXX with the industry’s most comprehensive and flexible PLM solution. We invite XXXXXXX to join Aras’s growing open source PLM community.<o:p></o:p>

<o:p></o:p>

Only the Aras platform is based on a modern, model-based service-oriented architecture that redefines the economics and possibilities for deploying software that empowers end-users and enables businesses to meet and exceed their objectives.<o:p></o:p>

· Every manufacturing company is different and these differences are the competitive advantage that separate leaders from commodity suppliers. XXXXXXX leads the market with innovative processes and ideas, and impressive growth rates; the XXXXXXX differences are clearly a competitive business advantage.<o:p></o:p>

· All companies change. Business change is a healthy and necessary process to maintain leadership. To remain static is to stagnate and join the masses of the commodity manufacturers. Critical business systems must evolve and change with the business and market conditions.<o:p></o:p>

· XXXXXXX needs a PLM system that can support their edge now, and through all future process changes driven by growth, new opportunities and responses to external competitive threats. An out-of-the-box PLM system that imposes “best practices” processes, that are not consistent with XXXXXXX’s processes, compromises the company’s edge and drives it to become a clone of the commodity manufacturers. <o:p></o:p>

· Aras Innovator is proven to deliver vastly scalable, robust and flexible solutions that can be deployed quickly and iteratively adapted to meet evolving needs and requirements in a fraction of the time required by conventional technologies.<o:p></o:p>

Only Aras can deliver a single solution that includes all of XXXXXXX Parts, Materials, BOMs, Formulas, Packaging, Supply Chain and Labeling data and processes in a uniform, consolidated database; accessible by the entire extended enterprise.<o:p></o:p>

· Many PLM products were developed through the acquisition of un-related software companies, which were then stapled together into a fusion of marketing hype and called a solution. Data is not integrated, processes do not flow and connect, and the end-to-end solution only works within PowerPoint.<o:p></o:p>

· Aras Innovator was designed from day-one in 2000 to be a platform for multi-application suites. All of the applications developed by Aras, by partners and by our community members are inherently integrated, with merged data models, and all run simultaneously. With one logon, your end-users have access to all of their data and processes.<o:p></o:p>

· Aras Innovator is the only enterprise PLM with a completely Web-based open architecture that allows 100% of the functionality in a simple Web interface. All XXXXXXX employees, the extended enterprise of trading partners and suppliers, and even your customers will be connected to a single, holistic system, with military-grade security access controls.<o:p></o:p>

Aras's proven, comprehensive solutions and novel open community approach meet the needs of organizations who share a common goal: Operational Excellence. We encourage XXXXXXX to join industry leaders such as Xerox, Motorola and many more using the Aras Enterprise Open Source approach to PLM. <o:p></o:p>

00) RFP Response Introduction

Darian — Fri, 29 Jul 2011 14:45:44 GMT

Revision 11 posted to On-Line RFP by Darian on 7/29/2011 10:45:44 AM

00) RFP Response Introduction

<o:p></o:p>

00) RFP Response Introduction

Darian — Fri, 29 Jul 2011 14:42:35 GMT

Revision 10 posted to On-Line RFP by Darian on 7/29/2011 10:42:35 AM

00) RFP Response Introduction

Executive Summary

Aras Corporation is pleased to submit our Technical Proposal provide a response to XXXXXXX Request for Proposal an RFP/RFQ for a Product Lifecycle Management (PLM).

Aras Corp is DifferentSolution. As you will see by the enclosed information, Aras Innovator® is uniquely qualified to meet the only complete requirements of XXXXXXX with the industry’s most comprehensive and flexible PLM solutionsuite powered by an advanced Model-Based SOA architecture proven . We invite XXXXXXX to deliver robust, scalable and highly flexible join Aras’s growing open source PLM and CM solutionscommunity.<o:p></o:p>

<o:p> </o:p>

Only the Aras platform is based on a modern, model-based service-oriented architecture that redefines the only PLM economics and possibilities for deploying software that empowers end-users and enables businesses to meet and exceed their objectives.<o:p></o:p>

·         Every manufacturing company is different and these differences are the competitive advantage that separate leaders from commodity suppliers. XXXXXXX leads the market with an enterprise open source business model innovative processes and ideas, and impressive growth rates; the XXXXXXX differences are clearly a growing community of competitive business advantage. <o:p></o:p>

·         All companies that are collaborating on implementing change. Business change is a full spectrum of configuration management, engineering, supply chain, sales, quality healthy and manufacturing applicationsnecessary process to maintain leadership.

The power To remain static is to stagnate and join the masses of the leading architectural approach combined commodity manufacturers. Critical business systems must evolve and change with the best business and market conditions.<o:p></o:p>

·         XXXXXXX needs a PLM system that can support their edge now, and through all future process changes driven by growth, new opportunities and responses to external competitive threats. An out-of-the-box PLM system that imposes “best practicesidea exchange ” processes, that are not consistent with XXXXXXX’s processes, compromises the company’s edge and drives it to become a clone of the open community ensures commodity manufacturers. <o:p></o:p>

·         Aras Innovator is proven to deliver vastly scalable, robust and flexible solutions that customers can deploy be deployed quickly and can iteratively adapt their PLM and CM practices adapted to meet new competitive evolving needs and requirements in a fraction of the time required by conventional enterprise PLM/PDM systemstechnologies.<o:p></o:p>

Only Aras proven, comprehensive solutions and our novel community approach meet the needs of businesses who share can deliver a common goal - Operational Excellence. We encourage XXXXX to join Xeroxsingle solution that includes all of XXXXXXX Parts, MotorolaMaterials, Lockheed Martin BOMs, Formulas, Packaging, Supply Chain and many more of the worlds leading companies Labeling data and processes in using a uniform, consolidated database; accessible by the Aras entire extended enterpriseopen source approach to PLM and CM.

Integrated <o:p></o:p>

·         Many PLM Solution: Aras Innovator is a completely integrated solution to cover products were developed through the entire PLM process. The product engineering and program management solutions provide real-time project collaboration. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL/AML (approved vendor/manufacturer lists), quality plans, supplier qualification informationacquisition of un-related software companies, as well as other deliverables associated with which were then stapled together into a project or product such as toolingfusion of marketing hype and called a solution.   Data is not integrated, firmwareprocesses do not flow and connect, and technical documentationthe end-to-end solution only works within PowerPoint.<o:p></o:p>

·         Aras Innovator combines open Internet standards, and business application templates was designed from day-one in a unique service-oriented architecture 2000 to create be a powerful alternative to traditional PLM/PDM systemsplatform for multi-application suites.Aras Innovator All of the applications can be quickly tailored and extended to meet specific business requirements: business itemsdeveloped by Aras, business logicby partners and by our community members are inherently integrated, workflowswith merged data models, and even all run simultaneously. With one logon, your end-users have access to all of their data structures are created and modified in real-time using browser-based graphical administration toolsprocesses.

Enterprise Class Support:<o:p></o:p>

·         Aras sells Innovator is the only enterprise class support subscriptions that provide a simple and complete way for companies to implement PLM and CM best practices using Aras enterprise solutions and ensure with a completely Web-based open architecture that each end user has full access to their mission critical PLM allows 100% of the functionality in a simple Web interface. Aras UNLIMITED Support Subscriptions uniquely combine unlimiteduser access to any & all of All XXXXXXX employees, the Aras solutions with certified softwareextended enterprise of trading partners and suppliers, live supportand even your customers will be connected to a single, software patchesholistic system, and with military-grade security updatesaccess controls.The enterprise-class support ensures that XXXXXX<o:p></o:p>

Aras's PLM system can be used with confidence by employeesproven, trade partners comprehensive solutions and novel open community approach meet the entire supply chainneeds of organizations who share a common goal: Operational Excellence. We encourage XXXXXXX to join industry leaders such as Xerox, Motorola and many more using the Aras Enterprise Open Source approach to PLM. <o:p></o:p>

00) RFP Response Introduction

Darian — Thu, 22 Jul 2010 14:19:10 GMT
Revision 9 posted to On-Line RFP by Darian on 7/22/2010 10:19:10 AM

A00) RFP Response Introduction

Executive Summary

Aras Corporation is pleased to submit our Technical Proposal response to XXXXXXX Request for Proposal for a Product Lifecycle Management (PLM).

Aras Corp is Different

Aras Innovator® is the only PLM solution suite powered by an advanced Model-Based SOA architecture proven to deliver robust, scalable and highly flexible PLM and CM solutions.

Aras is the only PLM software company with an enterprise open source business model and a growing community of companies that are collaborating on implementing a full spectrum of configuration management, engineering, supply chain, sales, quality and manufacturing applications.

The power of the leading architectural approach combined with the best practices idea exchange of the open community ensures that customers can deploy quickly and can iteratively adapt their PLM and CM practices to meet new competitive requirements in a fraction of the time required by conventional enterprise PLM/PDM systems. Aras proven, comprehensive solutions and our novel community approach meet the needs of businesses who share a common goal - Operational Excellence. We encourage XXXXX to join Xerox, Motorola, Lockheed Martin and many more of the worlds leading companies in using the Aras enterprise open source approach to PLM and CM.

Integrated PLM Solution: Aras Innovator is a completely integrated solution to cover the entire PLM process. The product engineering and program management solutions provide real-time project collaboration. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL/AML (approved vendor/manufacturer lists), quality plans, supplier qualification information, as well as other deliverables associated with a project or product such as tooling, firmware, and technical documentation. Aras Innovator combines open Internet standards, and business application templates in a unique service-oriented architecture to create a powerful alternative to traditional PLM/PDM systems. Aras Innovator applications can be quickly tailored and extended to meet specific business requirements: business items, business logic, workflows, and even data structures are created and modified in real-time using browser-based graphical administration tools.

Enterprise Class Support: Aras sells enterprise class support subscriptions that provide a simple and complete way for companies to implement PLM and CM best practices using Aras enterprise solutions and ensure that each end user has full access to their mission critical PLM functionality. Aras UNLIMITED Support Subscriptions uniquely combine unlimiteduser access to any & all of the Aras solutions with certified software, live support, software patches, and security updates. The enterprise-class support ensures that XXXXXX's PLM system can be used with confidence by employees, trade partners and the entire supply chain.

A) RFP Response Introduction

Darian — Thu, 15 Jul 2010 15:16:25 GMT
Revision 8 posted to On-Line RFP by Darian on 7/15/2010 11:16:25 AM

A) RFP Response Introduction

Executive Summary

Aras Corporation is pleased to submit our Technical Proposal response to XXXXXXX Request for Proposal for a Product Lifecycle Management (PLM).

Aras Corp is Different

Aras Innovator® is the only PLM solution suite powered by an advanced Model-Based SOA architecture proven to deliver robust, scalable and highly flexible PLM and CM solutions.

Aras is the only PLM software company with an enterprise open source business model and a growing community of companies that are collaborating on implementing a full spectrum of configuration management, engineering, supply chain, sales, quality and manufacturing applications.

The power of the leading architectural approach combined with the best practices idea exchange of the open community ensures that customers can deploy quickly and can iteratively adapt their PLM and CM practices to meet new competitive requirements in a fraction of the time required by conventional enterprise PLM/PDM systems. Aras proven, comprehensive solutions and our novel community approach meet the needs of businesses who share a common goal - Operational Excellence. We encourage XXXXX to join Xerox, Motorola, Lockheed Martin and many more of the worlds leading companies in using the Aras enterprise open source approach to PLM and CM.

Integrated PLM Solution: Aras Innovator is a completely integrated solution to cover the entire PLM process. The product engineering and program management solutions provide real-time project collaboration. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL/AML (approved vendor/manufacturer lists), quality plans, supplier qualification information, as well as other deliverables associated with a project or product such as tooling, firmware, and technical documentation. Aras Innovator combines open Internet standards, and business application templates in a unique service-oriented architecture to create a powerful alternative to traditional PLM/PDM systems. Aras Innovator applications can be quickly tailored and extended to meet specific business requirements: business items, business logic, workflows, and even data structures are created and modified in real-time using browser-based graphical administration tools.

Enterprise Class Support: Aras sells enterprise class support subscriptions that provide a simple and complete way for companies to implement PLM and CM best practices using Aras enterprise solutions and ensure that each end user has full access to their mission critical PLM functionality. Aras UNLIMITED Support Subscriptions uniquely combine unlimiteduser access to any & all of the Aras solutions with certified software, live support, software patches, and security updates. The enterprise-class support ensures that XXXXXX's PLM system can be used with confidence by employees, trade partners and the entire supply chain.

A) RFP Response Introduction

Peter Schroer — Tue, 17 Mar 2009 18:22:09 GMT
Revision 7 posted to On-Line RFP by Peter Schroer on 3/17/2009 2:22:09 PM

A) RFP Response Introduction

Executive Summary

Aras Corporation is pleased to submit our Technical Proposal response to XXXXXXX Request for Proposal for a Product Lifecycle Management (PLM).

Aras Corp is DifferentAras Innovator® is the only PLM solution suite powered by an advanced Model-Based SOA architecture proven to deliver robust, scalable and highly flexible PLM and CM solutions.

Aras is the only PLM software company with an enterprise open source business model and a growing community of companies that are collaborating on implementing a full spectrum of configuration management, engineering, supply chain, sales, quality and manufacturing applications.

The power of the leading architectural approach combined with the best practices idea exchange of the open community ensures that customers can deploy quickly and can iteratively adapt their PLM and CM practices to meet new competitive requirements in a fraction of the time required by conventional enterprise PLM/PDM systems. Aras proven, comprehensive solutions and our novel community approach meet the needs of businesses who share a common goal - Operational Excellence. We encourage XXXXX to join Xerox, Motorola, Lockheed Martin and many more of the worlds leading companies in using the Aras enterprise open source approach to PLM and CM.

Integrated PLM Solution:Aras Innovator is a completely integrated solution to cover the entire PLM process. The product engineering and program management solutions provide real-time project collaboration. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL/AML (approved vendor/manufacturer lists), quality plans, supplier qualification information, as well as other deliverables associated with a project or product such as tooling, firmware, and technical documentation. Aras Innovator combines open Internet standards, and business application templates in a unique service-oriented architecture to create a powerful alternative to traditional PLM/PDM systems. Aras Innovator applications can be quickly tailored and extended to meet specific business requirements: business items, business logic, workflows, and even data structures are created and modified in real-time using browser-based graphical administration tools.

Enterprise Class Support: Aras sells enterprise class support subscriptions that provide a simple and complete way for companies to implement PLM and CM best practices using Aras enterprise solutions and ensure that each end user has full access to their mission critical PLM functionality. Aras UNLIMITED Support Subscriptions uniquely combine unlimiteduser access to any & all of the Aras solutions with certified software, live support, software patches, and security updates. The enterprise-class support ensures that XXXXXX's PLM system can be used with confidence by employees, trade partners and the entire supply chain.

A) Introduction

Peter Schroer — Fri, 13 Mar 2009 20:06:39 GMT
Revision 6 posted to On-Line RFP by Peter Schroer on 3/13/2009 4:06:39 PM

A) Introduction

Executive Summary

Aras Corporation is pleased to submit our Technical Proposal response to XXXXXXX Request for Proposal for a Product Lifecycle Management (PLM).

Aras Corp is Different:Aras Innovator® is the only PLM solution suite powered by an advanced Model-Based SOA architecture proven to deliver robust, scalable and highly flexible PLM and CM solutions.

Aras is the only PLM software company with an enterprise enterprise open source business model and a growing community of companies that are collaborating on implementing a full spectrum of configuration management, engineering, supply chain, sales, quality and manufacturing applications.

The power of the leading architectural approach combined with the best practices idea exchange of the open community ensures that customers can deploy quickly and can iteratively adapt their PLM and CM practices to meet new competitive requirements in a fraction of the time required by conventional enterprise PLM/PDM systems. <st1:place w:st="on">Aras</st1:place>' Aras proven, comprehensive solutions and our novel community approach meet the needs of businesses who share a common goal - Operational Excellence. We encourage <st1:country-region w:st="on">XXXXX </st1:country-region>to XXXXX to join Xerox, Motorola, Lockheed Martin and many more of the worlds leading companies in using the <st1:place w:st="on">Aras</st1:place> Aras enterprise open source approach to PLM and CM.

Integrated PLM Solution: <st1:place w:st="on">Aras</st1:place> Aras Innovator is a completely integrated solution to cover the entire PLM process. The product engineering and program management solutions provide real-time project collaboration. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL/AML (approved vendor/manufacturer lists), quality plans, supplier qualification information, as well as other deliverables associated with a project or product such as tooling, firmware, and technical documentation. Aras Innovator combines open Internet standards, and business application templates in a unique service-oriented architecture to create a powerful alternative to traditional PLM/PDM systems. Aras Innovator applications can be quickly tailored and extended to meet specific business requirements: business items, business logic, workflows, and even data structures are created and modified in real-time using browser-based graphical administration tools.

<st1:city w:st="on">

Enterprise </st1:city>Class Support: Aras sells enterprise class support subscriptions that provide a simple and complete way for companies to implement PLM and CM best practices using <st1:place w:st="on">Aras</st1:place> Aras enterprise solutions and ensure that each end user has full access to their mission critical PLM functionality. Aras UNLIMITED Support Subscriptions uniquely combine unlimiteduser access to any & all of the <st1:place w:st="on">Aras</st1:place> Aras solutions with certified software, live support, software patches, and security updates. The enterprise-class support ensures that XXXXXXis XXXXXX's PLM system can be used with confidence by employees, trade partners and the entire supply chain.

A) Introduction

Peter Schroer — Fri, 13 Mar 2009 19:56:56 GMT
Revision 5 posted to On-Line RFP by Peter Schroer on 3/13/2009 3:56:56 PM

A) Introduction

Executive Summary

Aras Corporation is pleased to submit our Technical Proposal response to XXXXXXX Request for Proposal for a Product Lifecycle Management (PLM).    <o:p></o:p>

<o:p> </o:p>

Aras Corp is Different:    Aras Innovator^® is the only PLM solution suite powered by an advanced Model-Based SOA architecture proven to deliver robust, scalable and highly flexible PLM and CM solutions.    <o:p></o:p>

Aras is the only PLM software company with an enterprise open source business model and a growing community of companies that are collaborating on implementing a full spectrum of configuration management, engineering, supply chain, sales, quality and manufacturing applications. <o:p></o:p>

<o:p></o:p>

The power of the leading architectural approach combined with the best practices idea exchange of the open community ensures that customers can deploy quickly and can iteratively adapt their PLM and CM practices to meet new competitive requirements in a fraction of the time required by conventional enterprise PLM/PDM systems. <st1:place w:st="on">Aras</st1:place>' proven, comprehensive solutions and our novel community approach meet the needs of businesses who share a common goal - Operational Excellence. We encourage <st1:country-region w:st="on">XXXXX </st1:country-region>to join Xerox, Motorola, Lockheed Martin and many more of the worlds leading companies in using the <st1:place w:st="on">Aras</st1:place> enterprise open source approach to PLM and CM.<o:p></o:p>

<o:p> </o:p>

Integrated PLM Solution: <st1:place w:st="on">Aras</st1:place> Innovator is a completely integrated solution to cover the entire PLM process. The product engineering and program management solutions provide real-time project collaboration. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL/AML (approved vendor/manufacturer lists), quality plans, supplier qualification information, as well as other deliverables associated with a project or product such as tooling, firmware, and technical documentation. Aras Innovator combines open Internet standards, and business application templates in a unique service-oriented architecture to create a powerful alternative to traditional PLM/PDM systems. Aras Innovator applications can be quickly tailored and extended to meet specific business requirements: business items, business logic, workflows, and even data structures are created and modified in real-time using browser-based graphical administration tools.<o:p></o:p>

<o:p> </o:p>

<st1:city w:st="on">Enterprise</st1:city> Class Support: Aras sells enterprise class support subscriptions that provide a simple and complete way for companies to implement PLM and CM best practices using <st1:place w:st="on">Aras</st1:place> enterprise solutions and ensure that each end user has full access to their mission critical PLM functionality. Aras UNLIMITED Support Subscriptions uniquely combine unlimited user access to any & all of the <st1:place w:st="on">Aras</st1:place> solutions with certified software, live support, software patches, and security updates. The enterprise-class support ensures that XXXXXXis PLM system can be used with confidence by employees, trade partners and the entire supply chain.    <o:p></o:p>

A) Introduction

Peter Schroer — Fri, 13 Mar 2009 19:54:22 GMT
Revision 4 posted to On-Line RFP by Peter Schroer on 3/13/2009 3:54:22 PM

A) Introduction

Executive Summary

Aras Corporation is pleased to submit our Technical Proposal response to XXXXXXX Request for Proposal for a Product Lifecycle Management (PLM).    <o:p></o:p>

<o:p> </o:p>Aras Corp is Different:    Aras Innovator^® is the only PLM solution suite powered by an advanced Model-Based SOA architecture proven to deliver robust, scalable and highly flexible PLM and CM solutions.    <o:p></o:p>

Aras is the only PLM software company with an enterprise open source business model and a growing community of companies that are collaborating on implementing a full spectrum of configuration management, engineering, supply chain, sales, quality and manufacturing applications. <o:p></o:p>

<o:p></o:p>

The power of the leading architectural approach combined with the best practices idea exchange of the open community ensures that customers can deploy quickly and can iteratively adapt their PLM and CM practices to meet new competitive requirements in a fraction of the time required by conventional enterprise PLM/PDM systems. <st1:place w:st="on">Aras</st1:place>' proven, comprehensive solutions and our novel community approach meet the needs of businesses who share a common goal - Operational Excellence. We encourage <st1:country-region w:st="on">XXXXX </st1:country-region>to join Xerox, Motorola, Lockheed Martin and many more of the worlds leading companies in using the <st1:place w:st="on">Aras</st1:place> enterprise open source approach to PLM and CM.<o:p></o:p>

<o:p> </o:p>Integrated PLM Solution: <st1:place w:st="on">Aras</st1:place> Innovator is a completely integrated solution to cover the entire PLM process. The product engineering and program management solutions provide real-time project collaboration. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL/AML (approved vendor/manufacturer lists), quality plans, supplier qualification information, as well as other deliverables associated with a project or product such as tooling, firmware, and technical documentation. Aras Innovator combines open Internet standards, and business application templates in a unique service-oriented architecture to create a powerful alternative to traditional PLM/PDM systems. Aras Innovator applications can be quickly tailored and extended to meet specific business requirements: business items, business logic, workflows, and even data structures are created and modified in real-time using browser-based graphical administration tools.<o:p></o:p>

<o:p> </o:p><st1:city w:st="on">Enterprise</st1:city> Class Support: Aras sells enterprise class support subscriptions that provide a simple and complete way for companies to implement PLM and CM best practices using <st1:place w:st="on">Aras</st1:place> enterprise solutions and ensure that each end user has full access to their mission critical PLM functionality. Aras UNLIMITED Support Subscriptions uniquely combine unlimited user access to any & all of the <st1:place w:st="on">Aras</st1:place> solutions with certified software, live support, software patches, and security updates. The enterprise-class support ensures that XXXXXXis PLM system can be used with confidence by employees, trade partners and the entire supply chain.    <o:p></o:p>

<o:p> </o:p>

A) Introduction

Peter Schroer — Fri, 13 Mar 2009 19:52:29 GMT
Revision 3 posted to On-Line RFP by Peter Schroer on 3/13/2009 3:52:29 PM

A) Introduction

Executive Summary

Aras Corporation is pleased to submit our Technical Proposal response to your XXXXXXX Request For for Proposal for a Global Compliance System.   Your stated requirements fit squarely with our focus on manufacturing and quality operations. Based on the RFQ, Product Lifecycle Management (PLM).    <o:p></o:p>

<o:p> </o:p>

Aras feels strongly that we are uniquely positioned to provide You with solutions to accomplish your following goalsCorp is Different:    Aras Innovator^® is the only PLM solution suite powered by an advanced Model-Based SOA architecture proven to have one Global Compliance Systemdeliver robust, which can be utilized at all operations sites to manage quality scalable and regulatory requirementshighly flexible PLM and CM solutions.
to have all locations working from one system     <o:p></o:p>

Aras is the only PLM software company with accurate an enterprise open source business model and timely-updated information to help each location with managing quality performance

to have one system a growing community of companies that can load all quality documents into
to internally manage user personnel - with the ability to create and modify these templates internally without needing to rely are collaborating on the software supplier to help us with the designs.

Aras Innovator is implementing a robust full spectrum of configuration managementtool, based on a modern XML services oriented web architectureengineering, implementing the APQP principles for best practices regarding Quality Management and Planning.   Innovator provides configurationsupply chain, projectsales, workflow and quality management services for the management of data sets. Innovator does not however provide CAD application interfacing servicesand manufacturing applications. CAD File work-in-process data is best managed <o:p></o:p>

<o:p> </o:p>

The power of the leading architectural approach combined with the tools provided by best practices idea exchange of the CAD vendors. Innovator will interface with these CAD file managers and open community ensures that customers can vault the CAD native files deploy quickly and viewable files.

Aras was formed in March 2000 can iteratively adapt their PLM and “innovated” from the ground-up as a “new approach” software company CM practices to have some distinct advantages outlined meet new competitive requirements in our background section. All key members a fraction of the Aras team bring with them anywhere from 12-20 years experience in PDM and PLM system deployment.

Aras is committed to practical, flexible business ready software, freeing companies from the high costs, painful customizations, and protracted implementations of today's time required by conventional enterprise PLM/PDM systems. Aras' practical, <st1:place w:st="on">Aras</st1:place>' proven, and comprehensive solutions and our novel community approach meet the needs of businesses of all sizes who share a common goal - Operational Excellence. We encourage <st1:country-region w:st="on">XXXXX </st1:country-region>to join Xerox, Motorola, Lockheed Martin and many more of the worlds leading companies in using the <st1:place w:st="on">Aras</st1:place> enterprise open source approach to PLM and CM.<o:p></o:p>

<o:p> </o:p>

Integrated PLM Solution: Aras offers you <st1:place w:st="on">Aras</st1:place> Innovator is a completely integrated solution to cover the entire PLM process. The product engineering and program management tools will solutions provide real-time project and document review statuscollaboration. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL AVL/AML (approved vendor vendor/manufacturer lists), quality plans, sample request forms, supplier qualification information, as well as any other deliverable deliverables associated with a project or partproduct such as tooling, firmware, and technical documentation. Aras Innovator combines open Internet standards, common Microsoft components, and business application templates in a unique product service-oriented architecture to create a powerful alternative to traditional PLM/PDM systems. ArasInnovator-based Innovator applications can be quickly tailored and extended to meet specific business requirements: business items, business logic, workflows, and even data structures are created and modified in real-time using browser-based graphical administration tools.
Total Cost of Ownership<o:p></o:p>

<o:p> </o:p>

<st1:city w:st="on">Enterprise</st1:city> Class Support:By design, Aras sells enterprise class support subscriptions that provide a simple and complete way for companies to implement PLM reflects the lowest Total Cost of Ownership of any software and is changing the CM best practices using <st1:place w:st="on">Aras</st1:place> enterprise software value proposition. XML data exchange, graphical tailoring capabilities, solutions and intuitive browser-based interface all have a dramatic impact on the Total Cost of Ownership of a complete ensure that each end user has full access to their mission critical PLM solutionfunctionality.

Key Business Benefits
*Modeling Aras UNLIMITED Support Subscriptions uniquely combine unlimited user access to any & all of the way your business works
*Leverage existing infrastructure
*Lower operational costs through shortened cycle times and lower <st1:place w:st="on">Aras</st1:place> solutions with certified software, live supportcosts

Key Technology Benefits
*Lower cost of application development through template reusability , software patches, and the use of business objects
*Support a flexible architecture based on leading industry standards (.NET, SOAPsecurity updates. The enterprise-class support ensures that XXXXXXis PLM system can be used with confidence by employees, XML)
*Scalable trade partners and reliable platform to handle large volumes of data & processes as business needs growthe entire supply chain.    <o:p></o:p>

<o:p> </o:p>

A) Introduction

Peter Schroer — Fri, 13 Mar 2009 19:36:01 GMT
Revision 2 posted to On-Line RFP by Peter Schroer on 3/13/2009 3:36:01 PM

1.0 A) Introduction

Executive Summary

Aras is pleased to submit our response to your Request For Proposal for a Global Compliance System.   Your stated requirements fit squarely with our focus on manufacturing and quality operations. Based on the RFQ, Aras feels strongly that we are uniquely positioned to provide You with solutions to accomplish your following goals:

to have one Global Compliance System, which can be utilized at all operations sites to manage quality and regulatory requirements.

to have all locations working from one system with accurate and timely-updated information to help each location with managing quality performance

to have one system that can load all quality documents into
to internally manage user personnel - with the ability to create and modify these templates internally without needing to rely on the software supplier to help us with the designs.

Aras Innovator is a robust configuration management tool, based on a modern XML services oriented web architecture, implementing the APQP principles for best practices regarding Quality Management and Planning.   Innovator provides configuration, project, workflow and quality management services for the management of data sets. Innovator does not however provide CAD application interfacing services. CAD File work-in-process data is best managed with the tools provided by the CAD vendors. Innovator will interface with these CAD file managers and can vault the CAD native files and viewable files.

Aras was formed in March 2000 and “innovated” from the ground-up as a “new approach” software company to have some distinct advantages outlined in our background section. All key members of the Aras team bring with them anywhere from 12-20 years experience in PDM and PLM system deployment.

Aras is committed to practical, flexible business ready software, freeing companies from the high costs, painful customizations, and protracted implementations of today's conventional enterprise systems. Aras' practical, proven, and comprehensive solutions meet the needs of businesses of all sizes who share a common goal- Operational Excellence.
Integrated PLM Solution: Aras offers you a completely integrated solution to cover the entire PLM process. The product engineering and program management tools will provide real-time project and document review status. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL (approved vendor lists), quality plans, sample request forms, supplier qualification information, as well as any other deliverable associated with a project or part. Aras Innovator combines open Internet standards, common Microsoft components, and business application templates in a unique product architecture to create a powerful alternative to traditional PLM/PDM systems. Aras Innovator-based applications can be quickly tailored to meet specific business requirements: business items, business logic, workflows, and even data structures are created and modified in real-time using browser-based graphical administration tools.
Total Cost of Ownership: By design, Aras PLM reflects the lowest Total Cost of Ownership of any software and is changing the enterprise software value proposition. XML data exchange, graphical tailoring capabilities, and intuitive browser-based interface all have a dramatic impact on the Total Cost of Ownership of a complete PLM solution.

Key Business Benefits
*Modeling the way your business works
*Leverage existing infrastructure
*Lower operational costs through shortened cycle times and lower support costs

Key Technology Benefits
*Lower cost of application development through template reusability and the use of business objects
*Support a flexible architecture based on leading industry standards (.NET, SOAP, XML)
*Scalable and reliable platform to handle large volumes of data & processes as business needs grow

1.0 Introduction

Peter Schroer — Fri, 06 Mar 2009 18:11:21 GMT
Revision 1 posted to On-Line RFP by Peter Schroer on 3/6/2009 1:11:21 PM

Executive Summary

Aras is pleased to submit our response to your Request For Proposal for a Global Compliance System.   Your stated requirements fit squarely with our focus on manufacturing and quality operations. Based on the RFQ, Aras feels strongly that we are uniquely positioned to provide You with solutions to accomplish your following goals:

to have one Global Compliance System, which can be utilized at all operations sites to manage quality and regulatory requirements.

to have all locations working from one system with accurate and timely-updated information to help each location with managing quality performance

to have one system that can load all quality documents into
to internally manage user personnel - with the ability to create and modify these templates internally without needing to rely on the software supplier to help us with the designs.

Aras Innovator is a robust configuration management tool, based on a modern XML services oriented web architecture, implementing the APQP principles for best practices regarding Quality Management and Planning.   Innovator provides configuration, project, workflow and quality management services for the management of data sets. Innovator does not however provide CAD application interfacing services. CAD File work-in-process data is best managed with the tools provided by the CAD vendors. Innovator will interface with these CAD file managers and can vault the CAD native files and viewable files.

Aras was formed in March 2000 and “innovated” from the ground-up as a “new approach” software company to have some distinct advantages outlined in our background section. All key members of the Aras team bring with them anywhere from 12-20 years experience in PDM and PLM system deployment.

Aras is committed to practical, flexible business ready software, freeing companies from the high costs, painful customizations, and protracted implementations of today's conventional enterprise systems. Aras' practical, proven, and comprehensive solutions meet the needs of businesses of all sizes who share a common goal- Operational Excellence.
Integrated PLM Solution: Aras offers you a completely integrated solution to cover the entire PLM process. The product engineering and program management tools will provide real-time project and document review status. Version control and approval workflows can be applied to requirements documents, specifications, design files, FMEAs, BOMs, AVL (approved vendor lists), quality plans, sample request forms, supplier qualification information, as well as any other deliverable associated with a project or part. Aras Innovator combines open Internet standards, common Microsoft components, and business application templates in a unique product architecture to create a powerful alternative to traditional PLM/PDM systems. Aras Innovator-based applications can be quickly tailored to meet specific business requirements: business items, business logic, workflows, and even data structures are created and modified in real-time using browser-based graphical administration tools.
Total Cost of Ownership: By design, Aras PLM reflects the lowest Total Cost of Ownership of any software and is changing the enterprise software value proposition. XML data exchange, graphical tailoring capabilities, and intuitive browser-based interface all have a dramatic impact on the Total Cost of Ownership of a complete PLM solution.

Key Business Benefits
*Modeling the way your business works
*Leverage existing infrastructure
*Lower operational costs through shortened cycle times and lower support costs

Key Technology Benefits
*Lower cost of application development through template reusability and the use of business objects
*Support a flexible architecture based on leading industry standards (.NET, SOAP, XML)
*Scalable and reliable platform to handle large volumes of data & processes as business needs grow

04) Enterprise Open Source

Darian — Fri, 29 Jul 2011 14:11:11 GMT
Current revision posted to On-Line RFP by Darian on 7/29/2011 10:11:11 AM

04) Enterprise Open Source

User access –

Open Source, Aras Style

Corporate adoption of open source has grown significantly over the past decade. Open source products such as Linux, JBoss and Apache offer undisputed advantages in capability, control and cost, and have become the basis for mission critical systems needs to be accessible by our current level of approx 120 staff from multiple locations at companies around the globeworld. Most users will require read access

At Aras we recognized that these same advantages were desperately needed for general business administration type documentsapplications such as PLM. We also understood the additional requirements that would be important to ensure corporate confidence at the application layer.

Our approach was to combine multiple software formats, OSI-compliant open source, community source and approx 30 – 40% would require some form of write accesscommercial platforms, in a mixed source structure to provide the assurance necessary for business-critical solutions while delivering the flexibility for collaborative innovation. We call it enterprise open source.

Aras Innovator uses an Enterprise Open Sourcedistribution model. Customers can deploy unlimited number

No PLM License Fees

Advanced Technology

Open Source Solutions

Community Solution Framework

Commercial Platforms

Enterprise Open Source: By Business, For Business

The benefits of users the enterprise open source approach that we use include freedom from licensing expenses for PLM and complete control over your enterprise PLM solution along with all available modules and featuresthe benefits of corporate collaboration, for no charge. The fully functionalsuch as process improvements, production version of Aras Innovator can be downloaded solution enhancements and deployed for no chargebest practices sharing. Customers pay only

Open Source Solutions
The source for the training Aras solutions is governed by OSI compliant licenses and consulting services they requireis freely available to everyone for use, modification and the optional annual support contractsredistribution.

The system shall utilize a FlexLM or equivalent concurrent licensing to With Aras you have full control access and to facilitate scalable global licensing across over your enterprise applications including the companydata model / schema, business rules, definition of workflows, lifecycles, forms and more.

Exceeds requirement

And participation is always optional. Aras Innovator is distributed as enterprise open source , meaning all customers get unlimited user projects use permissive licenses and full functionality without a software license feethat do not require you to contribute back source code. There If your company implements competitive practices, you can keep them absolutely private.
Corporate Benefits:

Flexible

Extendable

Collaborative

Community Source Framework
The underlying enterprise application framework is also freely available with no software license managerfees, however, the download is a compiled binary. The Server has source code is distributed as community source which means it is available to a reporting tool for active sessions defined 'community,' in our case Aras subscribers.

This format provides the managed predictability and log-on events security required by your global IT organization while giving you complete control over your destiny.
Corporate Benefits:

Secure

Reliable

Managed

Standard Commercial Platforms
Our format relies on commonly available infrastructure software that can be is widely used to monitor and measure usagequalified in the enterprise. In our case, we currently utilize the Microsoft products: SQL Server, .NET and Windows Server.

Most companies already have buying agreements in place with Microsoft and have the IT skill sets on staff which makes it easy for them to use our solutions.
Corporate Benefits:

Proven

Trusted

Qualified

04) Enterprise Open Source

Darian — Thu, 22 Jul 2010 14:19:50 GMT
Revision 7 posted to On-Line RFP by Darian on 7/22/2010 10:19:50 AM

E04) Enterprise Open Source

User access – the systems needs to be accessible by our current level of approx 120 staff from multiple locations around the globe. Most users will require read access for general business administration type documents, and approx 30 – 40% would require some form of write access

Aras Innovator uses an Enterprise Open Source distribution model. Customers can deploy unlimited number of users with all available modules and features, for no charge. The fully functional, production version of Aras Innovator can be downloaded and deployed for no charge. Customers pay only for the training and consulting services they require, and the optional annual support contracts.

The system shall utilize a FlexLM or equivalent concurrent licensing to control access and to facilitate scalable global licensing across the company.

Exceeds requirement. Aras Innovator is distributed as enterprise open source, meaning all customers get unlimited user licenses and full functionality without a software license fee. There is no license manager. The Server has a reporting tool for active sessions and log-on events that can be used to monitor and measure usage.

E) Enterprise Open Source

Darian — Thu, 22 Jul 2010 13:21:15 GMT
Revision 6 posted to On-Line RFP by Darian on 7/22/2010 9:21:15 AM

E) Enterprise Open Source

User access – the systems needs to be accessible by our current level of approx 120 staff from multiple locations around the globe. Most users will require read access for general business administration type documents, and approx 30 – 40% would require some form of write access

Aras Innovator uses an Enterprise Open Source distribution model. Customers can deploy unlimited number of users with all available modules and features, for no charge. The fully functional, production version of Aras Innovator can be downloaded and deployed for no charge. Customers pay only for the training and consulting services they require, and the optional annual support contracts.

The system shall utilize a FlexLM or equivalent concurrent licensing to control access and to facilitate scalable global licensing across the company.

Exceeds requirement. Aras Innovator is distributed as enterprise open source, meaning all customers get unlimited user licenses and full functionality without a software license fee. There is no license manager. The Server has a reporting tool for active sessions and log-on events that can be used to monitor and measure usage.

E) Enterprise Open Source

Darian — Wed, 21 Jul 2010 14:47:38 GMT
Revision 5 posted to On-Line RFP by Darian on 7/21/2010 10:47:38 AM

FE) Enterprise Open Source

User access – the systems needs to be accessible by our current level of approx 120 staff from multiple locations around the globe. Most users will require read access for general business administration type documents, and approx 30 – 40% would require some form of write access

Aras Innovator uses an Enterprise Open Source distribution model. Customers can deploy unlimited number of users with all available modules and features, for no charge. The fully functional, production version of Aras Innovator can be downloaded and deployed for no charge. Customers pay only for the training and consulting services they require, and the optional annual support contracts.

F) Enterprise Open Source

Darian — Fri, 09 Jul 2010 16:03:35 GMT
Revision 4 posted to On-Line RFP by Darian on 7/9/2010 12:03:35 PM

F) Enterprise Open Source

Question Response
User access – the systems needs to be accessible by our current level of approx 120 staff from multiple locations around the globe. Most users will require read access for general business administration type documents, and approx 30 – 40% would require some form of write access

Aras Innovator uses an Enterprise Open Source distribution model. Customers can deploy unlimited number of users with all available modules and features, for no charge. The fully functional, production version of Aras Innovator can be downloaded and deployed for no charge. Customers pay only for the training and consulting services they require, and the optional annual support contracts.

F) Enterprise Open Source

Peter Schroer — Fri, 13 Mar 2009 19:38:06 GMT
Revision 3 posted to On-Line RFP by Peter Schroer on 3/13/2009 3:38:06 PM

6.0 F) Enterprise Open Source

Question Response

User access – the systems needs to be accessible by our current level of approx 120 staff from multiple locations around the globe. Most users will require read access for general business administration type documents, and approx 30 – 40% would require some form of write access Aras Innovator uses an Enterprise Open Source distribution model. Customers can deploy unlimited number of users with all available modules and features, for no charge. The fully functional, production version of Aras Innovator can be downloaded and deployed for no charge. Customers pay only for the training and consulting services they require, and the optional annual support contracts.

6.0 Enterprise Open Source

Peter Schroer — Mon, 09 Mar 2009 18:03:19 GMT
Revision 2 posted to On-Line RFP by Peter Schroer on 3/9/2009 2:03:19 PM

6.0 Enterprise Open Source

[ placeholder ]

Question Response

User access – the systems needs to be accessible by our current level of approx 120 staff from multiple locations around the globe. Most users will require read access for general business administration type documents, and approx 30 – 40% would require some form of write access Aras Innovator uses an Enterprise Open Source distribution model. Customers can deploy unlimited number of users with all available modules and features, for no charge. The fully functional, production version of Aras Innovator can be downloaded and deployed for no charge. Customers pay only for the training and consulting services they require, and the optional annual support contracts.

6.0 Enterprise Open Source

Peter Schroer — Fri, 06 Mar 2009 18:49:43 GMT
Revision 1 posted to On-Line RFP by Peter Schroer on 3/6/2009 1:49:43 PM

[ placeholder ]

06) Security and Access Control

Darian — Thu, 22 Jul 2010 15:43:15 GMT
Current revision posted to On-Line RFP by Darian on 7/22/2010 11:43:15 AM

06) Security and Access Control

FAQ

How is security handled in your system?

Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group?

The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles.

Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application?

Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application?

Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions?

There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances.

What additional security is required to limit the risk of unauthorized persons into the system?

No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory.

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how?

Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration

Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator.

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete

The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules.

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system

The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders.

Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions.

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces

Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity.

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder

The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up?

Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group?

Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.

The system shall allow Global internal resources and external suppliers (LAN, WAN, External) access to product data, configuration and implementation information.

Meets requirement. Aras Innovator is a web-based enterprise PLM system, highly scalable, and with a robust security model. Most Aras customers include both internal and external resources (suppliers, customer) as end-users of the PLM system.

The system shall have secure vaulting (storing) of unstructured data (files) and controlled updates and version tracking of vaulted and data that is under change control.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check out and version control files of any type, using just the standard Aras Innovator user interface.

CAD integrations are used to provide automation over and above the built-in file server functions. With the CAD, Office and EDA application integrations, menu's are added within the application to allow direct access to the Aras Innovator vaults without logging in to PLM separately. The integrations also automate the extraction and database upload of attributes, and the maintenance of inter-file dependencies.

The system shall be capable of controlling data ownership such that concurrent editing by different individuals is avoided.

Meets requirement.

The system shall be capable of importing, archiving, and managing any type of defining element utilized by the native authoring and/or viewing software being used. Examples are, but not limited to: PDF, IGES, STEP, Gerber, HPGL, .hex, .lib. ProE, AutoCAD, NX, Mentor, Cadence, Solidworks, Illustrator, PageMaker, PowerPoint, Freehand, MSOffice, zip, gzip.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check-out and version control files of any type, using just the standard Aras Innovator user interface. All of the formats noted in the requirement are supported.

The system shall provide a collaborative backbone with the means to effectively and securely exchange data and information and provide seamless access to product information across internal and external functional teams (LAN, WAN, External) down to the item level.

Meets requirement. Aras Innovator is used by many customers within the military and defense contractor community, and includes the security features demanded for those environments. As a 100% web enabled aplication, Aras Innovator has the capability to extend workflows, collaboration and quality management functions to the company's supply chain and customer base with the confidence of secure data transmission and bulletproof data access rights management.

Internal and external users that interact with the product data or any of the supporting data shall have access to the new system to view, sign off, export or contribute to the appropriate data to support their activities.

Meets requirement.

Internal and external users access control shall be configurable by owner, group, roles, etc.

Meets requirement. Aras security models are based on a hierarchial membership model with inheritance (similar to Microsoft Active Directory). Permissions to data and rights to run specific functions can be assigned to individuals or to groups.

The system shall allow external suppliers (LAN, WAN, External) controlled access to product data, configuration and implementation information. This access shall be controlled such that a supplier should not be able to see all of the product data, only a subset as defined by the business unit.

Meets requirement.

The system shall have a LDAP compliant access capability.

Meets requirement. Simple integration with Active Directory is explained in the installation guides. Aras Innovator also supports miced-mode authentication, which can dramatically simplify managing log-on accounts for a large supplier base. In mixed-mode authentication, internal users are authenticated with Active Directory (single-sign-on), while Supplier log-on accounts are managed only within Aras Innovator. This eliminates the need to create Active Directory accounts for all suppliers.

Describe how security is applied with respect to access by roles, access by region or country, access by business unit and/or contract type, and access restrictions for single documents.

Aras Innovator controls data access rights with a Permissions object which controls Read, Update, Delete, Discover and Change-Access by user or by Identity. "Identity" is an Aras Innovator concept analgous to a Role and/or Group. The permissions can be applied in patters across all documents linked to a Project, or set item-by-item in a "Need to Know" style control system. The Identity model in Aras Innovator is hierarchical with inheritance, allowing complex permissions management scheme to be implemented, with minimal on-going administration.

What types of authentication are supported?

Aras Innovator supports either Internal authentication (user account and passwords stored within the Innovator application) or external authentication. The most common external authentication is single-sign-on with Active Directory, however, the Aras authentication API allows an open interface to any external authentication method.

Aras Innovator can also be operated in a mixed-mode, in which some users are authenticated by Active Director (e.g. internal users) and others are authenticated using Aras Innovator user accounts (e.g. Suppliers).

Does the application provide a human-readable log that shows all activity (search/view/edit) by user?

Yes. There is a built-in configurable History feature that is viewable from within the application. There is also a human-readable server log accessible to IT.

Does the application provide a human-readable log that shows all activity (search/view/edit) by function?

Yes.

06) Security and Access Control

Darian — Thu, 22 Jul 2010 14:20:13 GMT
Revision 11 posted to On-Line RFP by Darian on 7/22/2010 10:20:13 AM

G06) Security and Access Control

FAQ

How is security handled in your system?

Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group?

The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles.

Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application?

Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application?

Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions?

There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances.

What additional security is required to limit the risk of unauthorized persons into the system?

No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory.

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how?

Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration

Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator.

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete

The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules.

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system

The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders.

Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions.

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces

Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity.

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder

The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up?

Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group?

Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.

The system shall allow Global internal resources and external suppliers (LAN, WAN, External) access to product data, configuration and implementation information.

Meets requirement. Aras Innovator is a web-based enterprise PLM system, highly scalable, and with a robust security model. Most Aras customers include both internal and external resources (suppliers, customer) as end-users of the PLM system.

The system shall have secure vaulting (storing) of unstructured data (files) and controlled updates and version tracking of vaulted and data that is under change control.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check out and version control files of any type, using just the standard Aras Innovator user interface.

CAD integrations are used to provide automation over and above the built-in file server functions. With the CAD, Office and EDA application integrations, menu's are added within the application to allow direct access to the Aras Innovator vaults without logging in to PLM separately. The integrations also automate the extraction and database upload of attributes, and the maintenance of inter-file dependencies.

The system shall be capable of controlling data ownership such that concurrent editing by different individuals is avoided.

Meets requirement.

The system shall be capable of importing, archiving, and managing any type of defining element utilized by the native authoring and/or viewing software being used. Examples are, but not limited to: PDF, IGES, STEP, Gerber, HPGL, .hex, .lib. ProE, AutoCAD, NX, Mentor, Cadence, Solidworks, Illustrator, PageMaker, PowerPoint, Freehand, MSOffice, zip, gzip.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check-out and version control files of any type, using just the standard Aras Innovator user interface. All of the formats noted in the requirement are supported.

The system shall provide a collaborative backbone with the means to effectively and securely exchange data and information and provide seamless access to product information across internal and external functional teams (LAN, WAN, External) down to the item level.

Meets requirement. Aras Innovator is used by many customers within the military and defense contractor community, and includes the security features demanded for those environments. As a 100% web enabled aplication, Aras Innovator has the capability to extend workflows, collaboration and quality management functions to the company's supply chain and customer base with the confidence of secure data transmission and bulletproof data access rights management.

Internal and external users that interact with the product data or any of the supporting data shall have access to the new system to view, sign off, export or contribute to the appropriate data to support their activities.

Meets requirement.

Internal and external users access control shall be configurable by owner, group, roles, etc.

Meets requirement. Aras security models are based on a hierarchial membership model with inheritance (similar to Microsoft Active Directory). Permissions to data and rights to run specific functions can be assigned to individuals or to groups.

The system shall allow external suppliers (LAN, WAN, External) controlled access to product data, configuration and implementation information. This access shall be controlled such that a supplier should not be able to see all of the product data, only a subset as defined by the business unit.

Meets requirement.

The system shall have a LDAP compliant access capability.

Meets requirement. Simple integration with Active Directory is explained in the installation guides. Aras Innovator also supports miced-mode authentication, which can dramatically simplify managing log-on accounts for a large supplier base. In mixed-mode authentication, internal users are authenticated with Active Directory (single-sign-on), while Supplier log-on accounts are managed only within Aras Innovator. This eliminates the need to create Active Directory accounts for all suppliers.

G) Security and Access Control

Darian — Wed, 21 Jul 2010 17:33:09 GMT
Revision 10 posted to On-Line RFP by Darian on 7/21/2010 1:33:09 PM

G) Security and Access Control

FAQ

How is security handled in your system?

Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group?

The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles.

Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application?

Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application?

Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions?

There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances.

What additional security is required to limit the risk of unauthorized persons into the system?

No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory.

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how?

Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration

Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator.

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete

The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules.

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system

The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders.

Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions.

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces

Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity.

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder

The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up?

Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group?

Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.

The system shall allow Global internal resources and external suppliers (LAN, WAN, External) access to product data, configuration and implementation information.

Meets requirement. Aras Innovator is a web-based enterprise PLM system, highly scalable, and with a robust security model. Most Aras customers include both internal and external resources (suppliers, customer) as end-users of the PLM system.

The system shall have secure vaulting (storing) of unstructured data (files) and controlled updates and version tracking of vaulted and data that is under change control.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check out and version control files of any type, using just the standard Aras Innovator user interface.

CAD integrations are used to provide automation over and above the built-in file server functions. With the CAD, Office and EDA application integrations, menu's are added within the application to allow direct access to the Aras Innovator vaults without logging in to PLM separately. The integrations also automate the extraction and database upload of attributes, and the maintenance of inter-file dependencies.

The system shall be capable of controlling data ownership such that concurrent editing by different individuals is avoided.

Meets requirement.

The system shall be capable of importing, archiving, and managing any type of defining element utilized by the native authoring and/or viewing software being used. Examples are, but not limited to: PDF, IGES, STEP, Gerber, HPGL, .hex, .lib. ProE, AutoCAD, NX, Mentor, Cadence, Solidworks, Illustrator, PageMaker, PowerPoint, Freehand, MSOffice, zip, gzip.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check-out and version control files of any type, using just the standard Aras Innovator user interface. All of the formats noted in the requirement are supported.

The system shall provide a collaborative backbone with the means to effectively and securely exchange data and information and provide seamless access to product information across internal and external functional teams (LAN, WAN, External) down to the item level.

Meets requirement. Aras Innovator is used by many customers within the military and defense contractor community, and includes the security features demanded for those environments. As a 100% web enabled aplication, Aras Innovator has the capability to extend workflows, collaboration and quality management functions to the company's supply chain and customer base with the confidence of secure data transmission and bulletproof data access rights management.

Internal and external users that interact with the product data or any of the supporting data shall have access to the new system to view, sign off, export or contribute to the appropriate data to support their activities.

Meets requirement.

Internal and external users access control shall be configurable by owner, group, roles, etc.

Meets requirement. Aras security models are based on a hierarchial membership model with inheritance (similar to Microsoft Active Directory). Permissions to data and rights to run specific functions can be assigned to individuals or to groups.

The system shall allow external suppliers (LAN, WAN, External) controlled access to product data, configuration and implementation information. This access shall be controlled such that a supplier should not be able to see all of the product data, only a subset as defined by the business unit.

Meets requirement.

The system shall have a LDAP compliant access capability.

Meets requirement. Simple integration with Active Directory is explained in the installation guides. Aras Innovator also supports miced-mode authentication, which can dramatically simplify managing log-on accounts for a large supplier base. In mixed-mode authentication, internal users are authenticated with Active Directory (single-sign-on), while Supplier log-on accounts are managed only within Aras Innovator. This eliminates the need to create Active Directory accounts for all suppliers.

G) Security and Access Control

Darian — Wed, 21 Jul 2010 15:53:59 GMT
Revision 9 posted to On-Line RFP by Darian on 7/21/2010 11:53:59 AM

G) Security and Access Control

FAQ

How is security handled in your system?

Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group?

The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles.

Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application?

Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application?

Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions?

There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances.

What additional security is required to limit the risk of unauthorized persons into the system?

No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory.

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how?

Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration

Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator.

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete

The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules.

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system

The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders.

Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions.

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces

Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity.

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder

The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up?

Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group?

Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.

The system shall allow Global internal resources and external suppliers (LAN, WAN, External) access to product data, configuration and implementation information.

Meets requirement. Aras Innovator is a web-based enterprise PLM system, highly scalable, and with a robust security model. Most Aras customers include both internal and external resources (suppliers, customer) as end-users of the PLM system.

The system shall have secure vaulting (storing) of unstructured data (files) and controlled updates and version tracking of vaulted and data that is under change control.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check out and version control files of any type, using just the standard Aras Innovator user interface.

CAD integrations are used to provide automation over and above the built-in file server functions. With the CAD, Office and EDA application integrations, menu's are added within the application to allow direct access to the Aras Innovator vaults without logging in to PLM separately. The integrations also automate the extraction and database upload of attributes, and the maintenance of inter-file dependencies.

The system shall be capable of controlling data ownership such that concurrent editing by different individuals is avoided.

Meets requirement.

The system shall be capable of importing, archiving, and managing any type of defining element utilized by the native authoring and/or viewing software being used. Examples are, but not limited to: PDF, IGES, STEP, Gerber, HPGL, .hex, .lib. ProE, AutoCAD, NX, Mentor, Cadence, Solidworks, Illustrator, PageMaker, PowerPoint, Freehand, MSOffice, zip, gzip.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check-out and version control files of any type, using just the standard Aras Innovator user interface. All of the formats noted in the requirement are supported.

G) Security and Access Control

Darian — Wed, 21 Jul 2010 15:50:20 GMT
Revision 8 posted to On-Line RFP by Darian on 7/21/2010 11:50:20 AM

G) Security and Access Control

FAQ

How is security handled in your system?

Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group?

The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles.

Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application?

Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application?

Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions?

There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances.

What additional security is required to limit the risk of unauthorized persons into the system?

No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory.

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how?

Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration

Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator.

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete

The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules.

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system

The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders.

Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions.

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces

Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity.

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder

The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up?

Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group?

Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.

The system shall allow Global internal resources and external suppliers (LAN, WAN, External) access to product data, configuration and implementation information.

Meets requirement. Aras Innovator is a web-based enterprise PLM system, highly scalable, and with a robust security model. Most Aras customers include both internal and external resources (suppliers, customer) as end-users of the PLM system.

The system shall have secure vaulting (storing) of unstructured data (files) and controlled updates and version tracking of vaulted and data that is under change control.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check out and version control files of any type, using just the standard Aras Innovator user interface.

CAD integrations are used to provide automation over and above the built-in file server functions. With the CAD, Office and EDA application integrations, menu's are added within the application to allow direct access to the Aras Innovator vaults without logging in to PLM separately. The integrations also automate the extraction and database upload of attributes, and the maintenance of inter-file dependencies.

The system shall be capable of controlling data ownership such that concurrent editing by different individuals is avoided.

Meets requirement.

G) Security and Access Control

Darian — Wed, 21 Jul 2010 14:48:34 GMT
Revision 7 posted to On-Line RFP by Darian on 7/21/2010 10:48:34 AM

HG) Security and Access Control

FAQ

How is security handled in your system?

Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group?

The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles.

Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application?

Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application?

Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions?

There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances.

What additional security is required to limit the risk of unauthorized persons into the system?

No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory.

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how?

Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration

Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator.

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete

The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules.

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system

The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders.

Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions.

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces

Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity.

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder

The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up?

Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group?

Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.

The system shall allow Global internal resources and external suppliers (LAN, WAN, External) access to product data, configuration and implementation information.

Meets requirement. Aras Innovator is a web-based enterprise PLM system, highly scalable, and with a robust security model. Most Aras customers include both internal and external resources (suppliers, customer) as end-users of the PLM system.

The system shall have secure vaulting (storing) of unstructured data (files) and controlled updates and version tracking of vaulted and data that is under change control.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check out and version control files of any type, using just the standard Aras Innovator user interface.

CAD integrations are used to provide automation over and above the built-in file server functions. With the CAD, Office and EDA application integrations, menu's are added within the application to allow direct access to the Aras Innovator vaults without logging in to PLM separately. The integrations also automate the extraction and database upload of attributes, and the maintenance of inter-file dependencies.

H) Security and Access Control

Darian — Wed, 21 Jul 2010 14:39:38 GMT
Revision 6 posted to On-Line RFP by Darian on 7/21/2010 10:39:38 AM

H) Security and Access Control

FAQ

How is security handled in your system?

Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group?

The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles.

Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application?

Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application?

Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions?

There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances.

What additional security is required to limit the risk of unauthorized persons into the system?

No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory.

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how?

Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration

Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator.

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete

The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules.

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system

The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders.

Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions.

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces

Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity.

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder

The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up?

Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group?

Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.

The system shall allow Global internal resources and external suppliers (LAN, WAN, External) access to product data, configuration and implementation information.

Meets requirement. Aras Innovator is a web-based enterprise PLM system, highly scalable, and with a robust security model. Most Aras customers include both internal and external resources (suppliers, customer) as end-users of the PLM system.

The system shall have secure vaulting (storing) of unstructured data (files) and controlled updates and version tracking of vaulted and data that is under change control.

Meets requirement. Aras Innovator vault server is file type independent, and is able to provide versioning and configuration management for any file type. End-users are able to check-in, check out and version control files of any type, using just the standard Aras Innovator user interface.

CAD integrations are used to provide automation over and above the built-in file server functions. With the CAD, Office and EDA application integrations, menu's are added within the application to allow direct access to the Aras Innovator vaults without logging in to PLM separately. The integrations also automate the extraction and database upload of attributes, and the maintenance of inter-file dependencies.

H) Security and Access Control

Darian — Wed, 21 Jul 2010 13:17:45 GMT
Revision 5 posted to On-Line RFP by Darian on 7/21/2010 9:17:45 AM

H) Security and Access Control

FAQ

How is security handled in your system?

Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group?

The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles.

Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application?

Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application?

Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions?

There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances.

What additional security is required to limit the risk of unauthorized persons into the system?

No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory.

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how?

Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration

Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator.

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete

The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules.

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system

The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders.

Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions.

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces

Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity.

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder

The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up?

Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group?

Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.

The system shall allow Global internal resources and external suppliers (LAN, WAN, External) access to product data, configuration and implementation information.

Meets requirement. Aras Innovator is a web-based enterprise PLM system, highly scalable, and with a robust security model. Most Aras customers include both internal and external resources (suppliers, customer) as end-users of the PLM system.

H) Security and Access Control

Darian — Fri, 09 Jul 2010 16:21:09 GMT
Revision 4 posted to On-Line RFP by Darian on 7/9/2010 12:21:09 PM

H) Security and Access Control

Question Response
FAQ

How is security handled in your system?

Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group?

The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles.

Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application?

Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application?

Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions?

There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances.

What additional security is required to limit the risk of unauthorized persons into the system?

No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory.

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how?

Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration

Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator.

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete

The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules.

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system

The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders.

Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions.

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces

Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity.

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder

The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up?

Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group?

Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.

H) Security and Access Control

Peter Schroer — Fri, 13 Mar 2009 19:38:29 GMT
Revision 3 posted to On-Line RFP by Peter Schroer on 3/13/2009 3:38:29 PM

8.0 H) Security and Access Control

Question Response

How is security handled in your system? Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Aras Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Aras Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Aras Innovator. These user accounts can be administered within the Aras Innovator administration screens or using Active Directory or any other user authentication system.

What information can be restricted? Can it be defined by user, by group? The Aras Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with Aras aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion. Similar to Active Directory, the Identity based security scheme is a membership manager. Each user is assigned membership into one of more groups (Identities). Those groups have a hierarchy of membership within other groups, inheriting the rights of the organizations of which they are members. Each business item (BOM, Drawing, Supplier, Workflow, Material Master, etc.) has a default access assigned to it upon creation. This default is then modified, as required, for each instance of the business item, throughout its lifecycle, to produce a true “need-to-know” list for each. Company business rules determine the level of security required; simple broad-brush, role based access or specific “need-to-know” lists of individuals for each Item/object. The power and flexibility of this model enables companies to include their suppliers and customers as real-time users within the PLM system with the confidence that visibility is restricted and intellectual property is protected.

Provide internal and external user security profiles. Fully compliant. The Innovator Identity Permissions security model is an Identity membership-based security scheme combined with a “need to know” object-level access list technology developed in partnership with our aerospace & defense industry customers. User’s are assigned to Identities (analogous to Groups) and all tasks, objects, forms etc. have a ‘need-to-know’ list of Identities that are allowed to access them for read, update, management and deletion.

What kind of security is required or recommended for file sharing of data reports, report layouts, and other documents which are stored outside of the database and application? Report Layouts are the only items stored outside of the Application Database. They are stored within the Microsoft Reporting Services database. Aras Corp recommends that the administrative passwords for Microsoft Reporting Services be kept within IT only.

What kind of security is required or recommended at the database level, aside from the application? Aras Corp recommends that the SQL Server “sa” password and the “Innovator” user passwords be kept secret. No other user accounts with SQL Server are required.

Is the security administration function separate from the regular administration functions? There is only a single client program that is the programmers interface, the administrators interface and the end-users interface. All the menus, forms and functions are segregated by the permissions associated with the login id. The various functions for security are segmented by login id as well as assigned roles of the login id. The highest security functions are only accessible by the root user. The Innovator Admin has a lesser overall security scope, allowing for the creation and modification of new item types. The access and capabilities of the various id’s and roles are fully configurable to meet your corporate security allowances

What additional security is required to limit the risk of unauthorized persons into the system? No additional security is required. Data security is enforced through the use of a single database logon and a single user account with access to the file vault. The Innovator application server acts as a proxy for all data and vault transactions, ensuring that all access to data is controlled by the Innovator Identity Permissions control layer. MD5 is used to encrypt certain data fields before transmission (e.g. passwords). All users are assigned a unique username/password account (Identity) within Innovator. These user accounts can be administered within the Innovator administration screens, or using Active Directory

Is the solution designed to handle external user access over the Internet utilizing DMZ (firewall) architecture? If so, how? Yes, Innovator is designed for access over the internet utilizing DMZ architecture as well as through intranet access. At Aras, we are able to access our demonstration server in Lawrence either thru direct internet access, or remotely logged into the intranet thru a VPN client. External users and suppliers will access the Innovator server via their Web Browser (Internet Explorer) connecting to the server either through a VPN connection or a secure Reverse-Proxy Server connection. The Aras www.myInnovator.com for example, sits 100% within the DMZ allowing cost effective and secure connection by both internal and external users.

Microsoft Active Directory – the software should interface with Microsoft Active Directory for easier management of user accounts and administration Aras Innovator can be used with Active Directory to enable single-sign-on for end-users. User accounts can be administered in AD, but the membership of those users in groups and roles for permissions, workflow assignments, etc, is administered inside Aras Innovator

Phased – access permissions to Product data will change through the phases of a product’s lifecycle, with the product’s development team having free access to all product info early in the products design phases, but formal change control processes will start to apply to much (but not all) of the products data as it nears the manufacture phase. Permissions may change through the following Phases:Early Development ? Mid Development ? New Product Intro ? Released ? Obsolete The Innovator Lifecycle Management service is used to automatically change Permissions when work items move through the Lifecycle. The administrator used the drag-n-drop Solution Studio tool to set the Lifecycle Permission rules

Role/Team/Product Based – permissions levels also need to be customisable per user, and per folder or document type to allow a high level of flexibility with the types of access that users have to the various areas within the system The Innovator Permission model is based on Identity Membership where User accounts are assigned one or more Identities, and these Identities can be organized hierarchically, with inheritance of permissions. Each business item instance can be assigned a default Permission set based on the Item type, or can be assigned unique, private permissions to a specific sub-set of Users (this enables tight Need-To-Know List management if it is required).

Access to change Permissions – Users such as Project Managers should have the ability to change Permissions to allow users that they choose to access their project folders. Innovator’s standard Permission model controls: Get, Add, Delete, Update and Change-Permissions

Supplier access – access to specific areas of the system would be provided to key suppliers, although a high level of security is required for this. Areas included would be part specifications for parts that a supplier provides, or even BOM and Change Management info for specific products that Contract Manufacturer produces Innovator is a 100% web application, designed from the ground up to implement secure web based communications and data-sharing throughout the “extended” organization. The administrator will use the drag-n-drop Solution Studio tools to define a permission scheme that supports the desired Supplier interface. Innovator has been successfully deployed across supply chains with high levels of security and data integrity

Permissions Copy – ability to copy the Permissions of an existing document or folder to another document or folder The Innovator model uses named Permission sets to simplify the administration of permissions on actual documents and other business items. [ setting private, need-to-know permissions on any item is also possible, but most customers find that named permission sets are the most effective means of maintaining security and minimizes administrative overhead ]. Permissions can be re-assigned, copied, and changed automatically (by the Lifecycle engine).

Active directory integration – How does it work in Innovator? How is it set up? Aras Innovator supports 3 modes of authentication. (1) all user account and password information is internal to Innovator, (2) logins are authenticated against an external system, usually Active Directory and (3) mixed mode, some users (such as suppliers) are authenticated by Innovator, others are authenticated using Active Directory. Active Directory authentication is sometimes called Single-Sign-On, because users who have logged onto the Windows domain can open their browsers to the Innovator URL and directly access the Innovator user interface without logging in to Innovator. Active Directory authentication eliminates the passwords stored in the Innovator database, and uses the AD authentication to allow access to Innovator. The system administrator will still need to create accounts within Innovator, and assign the Innovator specific permissions and group memberships. To configure Innovator for 3rd party authentication, please check the document “Aras Innovator 8.1 - Login Hooks.pdf” and also check the forums. There are several posts on this topic. There is a Active Directory specific Technical Note on the Aras web site. Check the new section of the Aras.com /University page named “Bill’s Workbench”.

Access rights to objects - are there only 4 choices - get, update, delete, can change access how does this work with user roles? Does the system have the ability to give promote access but not edit access to one role/group? Promote permission is assigned specifically for each possible promotion on each Lifecycle Map. In the Lifecycle Map editor, each State-to-State Promotion (the allowed “transitions”), has an Identity associated with it. Only members of this Identity will be allowed to make the promotion. In this way, Update permissions to the Item are separate from Promotion rights.