learn the latest trends and tools to help you id and remediate sod

Leverage Technology:Move Your Business Forward™

Risk and Compliance Financial Reporting Internal Audit Controls Catalog Application Security Advanced Analytics

A Leader in Risk Based Enterprise Controls Management Solutions

Copyright ©. Fulcrum Information Technology, Inc.Give me a lever long enough and a fulcrum on which to place it, and I shall move the world - Archimedes

LearnthelatesttrendsandtoolstohelpyouIDandremediateSODandothersecurityviolationsinyourOracleapplications

Monthly Educational Webinar SeriesAdil Khan, Managing Director

Jan 19, 2017

www.fulcrumway.comCopyright © FulcrumWay

Latest trends and tools to help you ID and remediate SOD

IntroductionsSegregation of Duties OverviewSoD Analysis False Positives and Exceptions Remediation Approach Case StudyQ&A

Agenda


FulcrumWay Clients Over 250 engagements

Successful Track Record

Government Oil and Gas

Healthcare

Communications

Financial Services

Transportation Natural ResourcesManufacturing

Retail

High TechMedia/Entertainment Life Sciences


FulcrumWay™ InsightGlobal Thought Leadership

Oracle Cloud – London – Feb 1-2 GRC Round Table, London, UKEducational Webinar – Feb 17th – Self Service User Provisioning Educational Webinar – Mar 23rd – Continuous Controls Monitoring

Oracle Cloud – Australia – March – GRC Round Table, Sydney, AustraliaCollaborate 17 – April 2-6 Las Vegas GRC Open HouseOracle Open World – October 1-5 – Mascone West, San Francisco, CAGitex – October 8-12 – GRC Round Table, Dubai UAEOracle UK Users Group – December – GRC Round Table, Birmingham, UKOracle Connect Africa – October – GRC Round Table, South Africa

Proven Expertise




Agenda


Are you ready for the Segregation of Duties Audit?SoD Overview


Responsibility

Form

Complicated Security ModelContains many overriding security attributes

Menu

Function

UserEvaluate User Access• Test by User • Test by Privilege

Manage Segregation of Duties• Identify incompatible Privileges• Predefined & Extensible SOD

Rule Sets

SoD Overview


SoD Rule Consists of Business Activities Made Up of FunctionsSoD Overview




Agenda


Validate Access Risks and Verify Security Model

UseDashboardsandReportFilterstoanalyzerisks

Identify SoD Rule violations and analyze issues using Violation Score Card. Drill down into Responsibility and User Violations by OU, and Module

SOD Analysis


Violations by User and ResponsibilitySOD Analysis

ResponsibilitywithSODConflict

UserwithSODConflict

AccesstoSupplierForm

AccesstoInvoiceApprovalPage


Responsibility ConfigurationSOD Analysis


Download in Excel for further reviewSOD Analytics




Agenda


What Are False Positives ?Users and Responsibilities

InactiveUsers

ExpiredUsers

TerminatedEmployeesstillactiveinEBS

End-DatedUsers

End-DatedResponsibilityAssignments

MenuswithoutPrompts

Inherent False+


WithoutGrantFlagusercannotaccesstheSub-

MenuorFunction

Menuwithoutpromptsdisablesusertoseeand

navigate

A menu is a hierarchical arrangement of application functions (forms). In the definition of a responsibility, the specified menudefines what is displayed in the navigator. The specified menu does not necessarily define the functions that can be accessed by the responsibility, which are granted.

What Are False Positives ?Oracle Menus Inherent False+


Ifyouspecifytheparameter

QUERY_ONLY=YES,theformopensinquery-onlymode.

Inherent False+ What Are False Positives ?Oracle Functions


TheFormPersonalizationfeatureallowsyoutodeclarativelyalterthebehaviorofForms-basedscreens,includingchangingproperties,executingbuiltins,displayingmessages,andaddingmenuentries.

Inherent False+ What Are False Positives ?Oracle Form Personalization


Aprofileisasetofchangeableoptionsthataffectthewayyourapplicationlooksandbehaves.Youcansetuserprofileoptionsatdifferentlevels:site,application,

responsibility,user,server,andorganization,dependingonhowtheprofileoptionsaredefined.

Inherent False+ What Are False Positives ?Oracle Profile Options


Global False PositivesFalse+ Checklist

Filter False+

Form Extensions

TableAudit

ConditionalFunctionAccess

DataAccess

FunctionAccess

Read-OnlyAccess

FunctionLimits

Filter False+

MenuAccess

Menu /Sub-Menu/Grants/Prompts

Data/Function Access

Disabled OracleResponsibilityAccess

EnabledOracleResponsibilityAccess

Read-OnlyRBACAccess

RBAC(Role BasedAccessControl)

Filter False+

FunctionLimits

Ledger DataAccess

CustomForms/Pages

Ledger SetAccess

Multi-Org Access

IT SupportAccess

MenuGrant Flag

Filter False+

User AccesstoSub-Menu

Inactive Users

Privileged User(Interface,etc)

User ResponsibilityAccessInactive

User ResponsibilityAccessActive

UserAccess enabled

Form Customization

Filter False+

Data AccessGroup(SharedServices)

GL AccessLimit

OperatingUnitAccess

OraclesecurityProfile




Agenda


Access/SOD Policy Management Approach

DetectSOD/PolicyViolations

AnalyzeViolations

CorrectRole

Access

MonitorViolationIncidents

ApplicationSecurityModel

ApplicationSecurity

Snapshot

ExceptionsCorrect

UserAccess

App Control Owners/ IS SecurityIS Security/

Audit/Compliance

Control Owners/

IS Security

ApplicationTest

EnvironmentAccess AnalyticsRules Manager Action Workflow

Application Administrator

Approach

Violations ManagerDataProbe ETL

Corrective Actions

Dashboard

ApplicationAccess Rules

Roles Manager


System Filters

False+Filters

DataSecurity

Read-Only

Custom

INVINV

UserOU

FormProfile

Role

Filters Type Conditions Results Excluded

Inactive User Global End-Date Users

Inactive Role Global End-Date Roles

Business Unit Global OrgName Organization

View Only Local Function Path Functions

DataSecurity Local Data Group Groups

Personalization Local Form/Page Forms

Approach

Role UserOU


Remove Inherent False PositivesApproach

UserGlobalConditionstofilter“inherent”FalsePositiveslike:

InactiveUsersInactiveResponsibilities

Read-onlyAccess


FilterConditionscanbesetuptoexcludeSODviolationsfrom

results

Approach Exclude Local Exceptions


RemediateViolations:RemoveUseraccesstoResponsibility

Approach Remediate SoD Rule Violations


CreateTargetRolestoeliminateSODViolations

Approach Remove inherent SOD Risks




Agenda


Fortune 500 Global Manufacturer Improves Segregation of Duty Controls across multiple ERP instances

OurClientFortune500company,manufacturesanddistributescoatings,specialtymaterials,andglassproducts.BusinessRunsonmultipleOracleEBS,SAPsystemsOver40,000employeesworld-wide

ChallengesReplacemultiplelegacysystemswithoneERPsolutionImprovedSegregationofDutycontrolswithinmissioncriticalapplicationsMaintainconsistentERPsystemaccessrolesacrossthesubsidiariesleveragingthesharedservicesmodelIncreaseexternalauditor’srelianceonERPAccessControlsMonitoring

SolutionsSafePaaSAccessPolicyManagerSafePaaSiAccessUserProviosning

Results:ReduceERPSODRemediationtimebyidentifyingandeliminating80%FalsePositivesresultinginover$50,000annualcostsavingsinAuditandRemediationCostsCreatedover100SegregationofDutycompliantRolesbybusinesssegmentwithtwoweeksfromFulcrumWayRoleTemplateswithinthecontrolscatalog.LoweredERPTotalCostofOwnershipbyreducingSoDremediationtimeandcostsbyensuringthatallusersaassignedonlythepre-approvedRolesImproveSoDandAccessControlstestingtimebyprovidingauditorstheaccesslogreportsshowingallUpdate,ReviewandApproveRoledesignchanges.AcceleratedERPAccessApprovaltimebyidentifyingvalidSODconflictsbeforetheRolesareassignedtoUsers.

Case Study


Sign-up for FREE 30 Days EvaluationQ & A

Register online to try out SafePaaS

learn the latest trends and tools to help you id and remediate sod

Software