Securing the Cube - Expert Cube Development with SSAS Multidimensional Models - page 255

The difference between the two becomes clear when during the life of the dimension;
new members appear in the hierarchy, for example, because new countries appear in
the underlying dimension table. If we used the Select all members option, these new
members would automatically be accessible to the role until we edited the role and
unchecked them; if, however we used the Deselect all members option, these new
members would not be accessible until we edited the role and specifically checked
them. We can think at these two options as setting the default behavior for how
to handle new members in the hierarchy. In most cases, it makes sense to use the
Deselect all members option.
Armed with this knowledge, we can now choose Deselect all members and then
check Canada . Here's what now happens when we query the cube through the role:
The Sales Territory hierarchy now appears as if Canada was the only country on it.
However, even if we don't filter on Country in the Excel worksheet we will still see
data because all of the members on the hierarchy above Canada are still there.
Visual Totals
When you secure dimension members, you need to pay attention to how the totals
are computed. In fact, if we look at the preceding screenshot carefully, we can see
something wrong. The Sales Amount for Canada is $16,355,770.46 USD but the Sales
Amount for North America is $79,353,361.17 and the Grand Total is $109,819,515.28 .
We've managed to deny access to the other countries in the hierarchy but their
values are still contributing to the totals at the Group level and Grand Totals. This
is a potential security loophole because, once again, a user might be able to derive a
value they should not have access to from values they can see.