Report Security in BBEC is handled in two separate ways, through SSRS and BBEC Site Security:

SQL Server Reporting Services (SSRS)

Basic report security is managed through SSRS, which is separate from CRM Security.  Since this security is entirely separate, it needs to be managed through the SSRS Report Manager OR through the "Report Explorer" in CRM by righ-clicking on a folder or report and selecting "Properties," then using the UI to set permissions for active directory users or groups:

Report Server Permissions Image

BBEC Site Security

If your organization uses Site Security, Blackbaud Enterprise CRM reports display only records or values that user/group has permission to see. For instance, if your organization uses site security, the amounts that appears in the Revenue Detail report include only revenue associated with the sites the user who generates the report has rights to access. An example of this is if a user with rights to SITE A was running a revenue report, the figures would not include revenue from constituents in SITE B.