Identify and monitoring multi-platform and cross-platform access control

Leverage Technology:
Move Your Business Forward™
Risk and Compliance Financial Reporting Internal Audit Controls Catalog Application Security Advanced Analytics
A Leader in Risk Based Enterprise Controls Management Solutions
Copyright ©. Fulcrum Information Technology, Inc.Give me a lever long enough and a fulcrum on which to place it, and I shall move the world - Archimedes
ID and Monitoring Multi-Platform and Cross-Platform Access Control
Jeffrey T. Hare, CPA CISA CIA
Eduardo Garibaldi, Director of Global Risk Advisory

www.fulcrumway.comPage 2Copyright © FulcrumWay
Introductions
Identifying and Monitoring Multi-Platform and Cross-
Platform Access Control Risks
Segregation of Duties Overview
SoD Analysis
False Positives and Exceptions
Remediation Approach
Q&A
Agenda

FulcrumWay Clients
Over 250 engagements
Successful
Track Record
Government Oil and Gas
Healthcare
Communications
Financial Services
Transportation Natural ResourcesManufacturing
Retail
High TechMedia/Entertainment Life Sciences

FulcrumWay™ Insight
Global Thought Leadership
Oracle Cloud – London – Feb 1-2 GRC Round Table,
London, UK
Educational Webinar – Feb 17th – Self Service User
Provisioning
Educational Webinar – Mar 23rd – Continuous
Controls Monitoring
Oracle Cloud – Australia – March – GRC Round
Table, Sydney, Australia
Collaborate 17 – April 2-6 Las Vegas GRC Open
House
Oracle Open World – October 1-5 – Mascone West,
San Francisco, CA
Gitex – October 8-12 – GRC Round Table, Dubai
UAE
Oracle UK Users Group – December – GRC Round
Table, Birmingham, UK
Oracle Connect Africa – October – GRC Round
Table, South Africa
Proven Expertise

Introductions
SoD Analysis
Q&A
Agenda

Identifying and Monitoring Multi-Platform and
Cross-Platform Access Control Risks
Most organizations have multiple software applications to help run their
business. Often there are several ERP and legacy applications that are
considered in-scope from a compliance perspective. Hear from industry
expert, Jeffrey T. Hare, CPA CISA CIA about common cross-platform and
multi-platform control risks and how organizations can mature their control
environment through necessary manual controls, monitoring controls, and
access controls.

Scenario 1: Multi-platform risks across Oracle E-
Business Suite and Hyperion
Organization uses Oracle E-Business Suite for core
applications and Hyperion for budgeting and
consolidations
Scenario 1

Risks Across Oracle E-Business Suite
and Hyperion
Oracle E-Business Suite
Using Journal Approval
Workflow that now
leverages AME.
All ‘manual JEs’ are
required to go through the
journal approval workflow
process
Hyperion
JEs can be entered and
posted by anyone
Manual controls of JEs
(outside system)
Budgeting
Consolidations
Multi-platform

Risks across Oracle E-Business Suite and
Hyperion
SoD Conflicts:
Enter Journals vs Journal
Sources
Enter Journals vs Journal
Authorization Limits
Enter Journals vs Profile
Option Values
Enter Journals vs AME Setups
Enter Journals vs Accounting
Setup Manager
Hyperion
SoD Conflicts
Enter Budgets vs Maintain
Budget Approvers
Multi-platform

Risks across Oracle E-Business Suite
and Hyperion
Sensitive Access Risks:
Journal Sources
Journal Authorization Limits
Profile Option Values
AME Setups
Budget Setups
Journal Import Correction
Accounting Setup Manager
Hyperion
Define Budget
Budget Approvers
Consolidation Setups
Enter Journals
Multi-platform

and Hyperion
Operational Sensitive
Access Risks:
Enter Journals
Post Journals
Chart of Account
maintenance (Flexfield
Values)
AutoPost
Hyperion
Access Risks:
None
Multi-platform

and Hyperion
Other Notes:
Further discussion on
how Mass Allocations and
Recurring Journals are
handled
Assumption is Journal
Approval workflow is
properly configured
Hyperion
Access Risks:
None
Multi-platform

Scenario 2: Cross-platform risks across Oracle E-Business
Suite and Oracle ERP Cloud
Organization uses Oracle E-Business Suite for core
applications (less Requisitions) and Oracle ERP Cloud
(Fusion) for Requisitions
Scenario 2

and Hyperion
Activities within EBS
Segregating JEs – Enter vs
Post
Approved Reqs are
converted to POs
POs are updated manually
since ERP Cloud doesn’t
support PO updates
Suppliers i/f’d from ERP
Cloud
Oracle ERP Cloud
Activities within ERP Cloud:
JEs not allowed
Approved Requisitions are
interfaced to EBS
Suppliers are interfaced to
EBS
Multi-platform

and Hyperion
Suppliers (none s/b entered)
AutoCreate Docs
Buyers
Purchase Orders
PO Setups – Document Types
PO Approval Setups
Payables Options
Oracle ERP Cloud
Suppliers
Requisition Approval Setup
Requisition Setups –
Document Types
Multi-platform

and Hyperion
SoD Conflicts:
PO’s vs Enter Goods
Receipts
Enter Suppliers vs Enter
PO’s
PO’s vs PO Options
Suppliers vs Payables
Options
PO’s vs Buyers
Oracle ERP Cloud
SoD Conflicts:
Requisitions vs Requisition
Approval Setup
Enter Suppliers vs
Requisitions
Multi-platform

and Hyperion
Cross Platform SoD
Conflicts:
Enter PO’s(EBS)
Oracle ERP Cloud
Cross Platform SoD
Conflicts:
Enter Suppliers (Cloud)
Multi-platform

Introductions
SoD Analysis
Q&A
Agenda

Are you ready for the Segregation of Duties
Audit?SoD Overview

The Big PictureSafePaaS
MonitorPaaS
ProcessPaaS/DocumentPaaS Operations Management
RiskPaaS
Risk Library KRI ManagerPolicy Manager
Process Definition
Workflow Business Rules
Audit Manager Audit Planner
Compliance Manager
Master Data Monitor
DataProbeIntegrationServices
Risk Assessments
AuditPaaS
Transaction Monitor App Configuration Monitor Rules Repository
Access Monitor SOD Policy Monitor Roles Manager
AccessPaaS
iAccess Policy based provisioning
Issue Manager
Survey Manager
Enterprise Risk Management
Continuous Controls Monitoring
Financial Governance Audit and Compliance Automation
IT Governance

Multi-platform

Responsibility
Form
Complicated Security Model
Contains many overriding security attributes
Menu
Function
User
Evaluate User Access
• Test by User
• Test by Privilege
Manage
Segregation of Duties
• Identify incompatible Privileges
• Predefined & Extensible SOD
Rule Sets
SoD Overview

Roles
Hyperion Security Model
High Risk of SOD Issues
Groups
Functions
User
Security Class
SoD Overview
• Test by User
Manage
Rule Sets

Role
Page
PeopleSoft Security Model
Permission List
Menu
User Profile
Component
SoD Overview
• Test by User
Manage
Rule Sets

JD Edwards Security Model
• Test by User
Manage
Rule Sets
Roles
Menu / Task
User
Form
Application
Versions
Report
Versions
SoD Overview

www.fulcrumway.comCopyright © FulcrumWay
Access/SOD Risk Based
Detect
SOD/Policy
Violations
Analyze
Violations
Correct
Role
Access
Monitor
Violation
Incidents
Application
Security
Model
Application
Security
Snapshot
Exceptions
Correct
User
Access
App Control Owners/
IS SecurityIS Security/
Audit/Compliance
Control
Owners/
IS Security
Application
Test
Environment
Access AnalyticsRules Manager Action Workflow
Application
Administrator
SOD Overview
Violations ManagerDataProbe ETL
Corrective
Actions
Dashboard
Application
Access
Rules
Roles Manager

SoD Rule Consists of Business Activities
Made Up of FunctionsSoD Overview

Introductions
SoD Analysis
Q&A
Agenda

Validate Access Risks and Verify Security
Model
Use Dashboards and Report Filters to analyze risks
Identify SoD Rule violations and analyze issues using Violation Score Card.
Drill down into Responsibility and User Violations by OU, and Module
SOD Analysis

Violations by User and ResponsibilitySOD Analysis
Responsibility
with SOD Conflict
User with
SOD Conflict
Access to
Supplier Form
Access to Invoice
Approval Page

Responsibility ConfigurationSOD Analysis

Download in Excel for further reviewSOD Analytics

Introductions
SoD Analysis
Q&A
Agenda

What Are False Positives ?
Users and Responsibilities
Inactive Users
Expired Users
Terminated
Employees still
active in EBS
End-Dated Users
End-Dated
Responsibility
Assignments
Menus without
Prompts
Inherent False+

Without Grant
Flag user can not
access the Sub-
Menu or Function
Menu without
prompts disables
user to see and
navigate
A menu is a hierarchical arrangement of application functions (forms). In the definition of a responsibility, the specified menu
defines what is displayed in the navigator. The specified menu does not necessarily define the functions that can be
accessed by the responsibility, which are granted.
Oracle MenusInherent False+

If you specify the
parameter
QUERY_ONLY=YES,
the form opens in
query-only mode.
Inherent False+
Oracle Functions

The Form Personalization feature allows
you to declaratively alter the behavior of
Forms-based screens, including changing
properties, executing builtins, displaying
messages, and adding menu entries.
Inherent False+
Oracle Form Personalization

A profile is a set of changeable options that affect the way
your application looks and behaves. You can set user
profile options at different levels: site, application,
responsibility, user, server, and organization, depending
on how the profile options are defined.
Inherent False+
Oracle Profile Options

Global False PositivesFalse+ Checklist
Filter False+
Form Extensions
Table Audit
Conditional Function Access
Data Access
Function Access
Read-Only Access
Function Limits
Filter False+
Menu Access
Menu / Sub-Menu / Grants / Prompts
Data / Function Access
Disabled Oracle Responsibility Access
Enabled Oracle Responsibility Access
Read-Only RBAC Access
RBAC (Role Based Access Control)
Filter False+
Function Limits
Ledger Data Access
Custom Forms/Pages
Ledger Set Access
Multi-Org Access
IT Support Access
Menu Grant Flag
Filter False+
User Access to Sub-Menu
Inactive Users
Privileged User (Interface, etc)
User Responsibility Access Inactive
User Responsibility Access Active
User Access enabled
Form Customization
Filter False+
Data Access Group (Shared Services)
GL Access Limit
Operating Unit Access
Oracle security Profile

Introductions
SoD Analysis
Q&A
Agenda

System Filters
False+ Filters
Data
Security
Read-
Only
Custom
INV
INV
User
OU
Form
Pro
file
Role
Filters Type Conditions Results Excluded
Inactive User Global End-Date Users
Inactive Role Global End-Date Roles
Business Unit Global Org Name Organization
View Only Local Function Path Functions
Data Security Local Data Group Groups
Personalization Local Form/Page Forms
Approach
Role User
OU

Remove Inherent False PositivesApproach
User Global Conditions to filter “inherent”
False Positives like:
Inactive Users
Inactive Responsibilities
Read-only Access

Fortune 500 Global Manufacturer Improves
Segregation of Duty Controls across multiple ERP instances
Our Client
Fortune 500 company, manufactures and distributes
coatings, specialty materials, and glass products.
Business Runs on multiple Oracle EBS, SAP systems
Over 40,000 employees world-wide
Challenges
Replace multiple legacy systems with one ERP
solution
Improved Segregation of Duty controls within
mission critical applications
Maintain consistent ERP system access roles across
the subsidiaries leveraging the shared services
model
Increase external auditor’s reliance on ERP Access
Controls Monitoring
Solutions
SafePaaS Access Policy Manager
SafePaaS iAccess User Proviosning
Results:
Reduce ERP SOD Remediation time by identifying and
eliminating 80% False Positives resulting in over $50,000
annual cost savings in Audit and Remediation Costs
Created over 100 Segregation of Duty compliant Roles
by business segment with two weeks from FulcrumWay
Role Templates within the controls catalog.
Lowered ERP Total Cost of Ownership by reducing SoD
remediation time and costs by ensuring that all users a
assigned only the pre-approved Roles
Improve SoD and Access Controls testing time by
providing auditors the access log reports showing all
Update, Review and Approve Role design changes.
Accelerated ERP Access Approval time by identifying
valid SOD conflicts before the Roles are assigned to
Users.
Case Study

Sign-up for FREE 30 Days EvaluationQ & A
Register online to try out
SafePaaS

Identify and monitoring multi-platform and cross-platform access control

More Related Content

Similar to Identify and monitoring multi-platform and cross-platform access control (20)

Recently uploaded (20)

Identify and monitoring multi-platform and cross-platform access control