Learn the latest trends and tools to help you id and remediate SOD

Leverage Technology:
Move Your Business Forward™
Risk and Compliance Financial Reporting Internal Audit Controls Catalog Application Security Advanced Analytics
A Leader in Risk Based Enterprise Controls Management Solutions
Copyright ©. Fulcrum Information Technology, Inc.Give me a lever long enough and a fulcrum on which to place it, and I shall move the world - Archimedes
Learn the latest trends and tools to help you ID and remediate SOD and other security
violations in your Oracle applications
Monthly Educational Webinar Series
Adil Khan, Managing Director
Jan 19, 2017

www.fulcrumway.comPage 2Copyright © FulcrumWay
Latest trends and tools to help you ID and
remediate SOD
Introductions
Segregation of Duties Overview
SoD Analysis
False Positives and Exceptions
Remediation Approach
Case Study
Q&A
Agenda

remediate SOD
Introductions
SoD Analysis
Case Study
Q&A
Agenda

FulcrumWay Clients
Over 250 engagements
Successful
Track Record
Government Oil and Gas
Healthcare
Communications
Financial Services
Transportation Natural ResourcesManufacturing
Retail
High TechMedia/Entertainment Life Sciences

FulcrumWay™ Insight
Global Thought Leadership
Oracle Cloud – London – Feb 1-2 GRC Round Table,
London, UK
Educational Webinar – Feb 17th
– Self Service User
Provisioning
Educational Webinar – Mar 23rd
– Continuous
Controls Monitoring
Oracle Cloud – Australia – March – GRC Round
Table, Sydney, Australia
Collaborate 17 – April 2-6 Las Vegas GRC Open
House
Oracle Open World – October 1-5 – Mascone West,
San Francisco, CA
Gitex – October 8-12 – GRC Round Table, Dubai
UAE
Oracle UK Users Group – December – GRC Round
Table, Birmingham, UK
Oracle Connect Africa – October – GRC Round
Table, South Africa
Proven Expertise

remediate SOD
Introductions
SoD Analysis
Case Study
Q&A
Agenda

Are you ready for the Segregation of Duties
Audit?SoD Overview

Responsibility
Form
Complicated Security Model
Contains many overriding security attributes
Menu
Function
User
Evaluate User Access
• Test by User
• Test by Privilege
Manage
Segregation of Duties
• Identify incompatible Privileges
• Predefined & Extensible SOD
Rule Sets
SoD Overview

SoD Rule Consists of Business Activities
Made Up of FunctionsSoD Overview

remediate SOD
Introductions
SoD Analysis
Case Study
Q&A
Agenda

Validate Access Risks and Verify Security
Model
Use Dashboards and Report Filters to analyze risks
Identify SoD Rule violations and analyze issues using Violation Score Card.
Drill down into Responsibility and User Violations by OU, and Module
SOD Analysis

Violations by User and ResponsibilitySOD Analysis
Responsibility
with SOD Conflict
User with
SOD Conflict
Access to
Supplier Form
Access to Invoice
Approval Page

Responsibility ConfigurationSOD Analysis

Download in Excel for further reviewSOD Analytics

remediate SOD
Introductions
SoD Analysis
Case Study
Q&A
Agenda

www.fulcrumway.comCopyright © FulcrumWay
What Are False Positives ?
Users and Responsibilities
Inactive Users
Expired Users
Terminated
Employees still
active in EBS
End-Dated Users
End-Dated
Responsibility
Assignments
Menus without
Prompts
Inherent False+

Without Grant
Flag user can not
access the Sub-
Menu or Function
Menu without
prompts disables
user to see and
navigate
A menu is a hierarchical arrangement of application functions (forms). In the definition of a responsibility, the specified menu
defines what is displayed in the navigator. The specified menu does not necessarily define the functions that can be
accessed by the responsibility, which are granted.
Oracle MenusInherent False+

If you specify the
parameter
QUERY_ONLY=YES,
the form opens in
query-only mode.
Inherent False+
Oracle Functions

The Form Personalization feature allows
you to declaratively alter the behavior of
Forms-based screens, including changing
properties, executing builtins, displaying
messages, and adding menu entries.
Inherent False+
Oracle Form Personalization

A profile is a set of changeable options that affect the way
your application looks and behaves. You can set user
profile options at different levels: site, application,
responsibility, user, server, and organization, depending
on how the profile options are defined.
Inherent False+
Oracle Profile Options

Global False PositivesFalse+ Checklist
Filter False+
Form Extensions
Table Audit
Conditional Function Access
Data Access
Function Access
Read-Only Access
Function Limits
Filter False+
Menu Access
Menu / Sub-Menu / Grants / Prompts
Data / Function Access
Disabled Oracle Responsibility Access
Enabled Oracle Responsibility Access
Read-Only RBAC Access
RBAC (Role Based Access Control)
Filter False+
Function Limits
Ledger Data Access
Custom Forms/Pages
Ledger Set Access
Multi-Org Access
IT Support Access
Menu Grant Flag
Filter False+
User Access to Sub-Menu
Inactive Users
Privileged User (Interface, etc)
User Responsibility Access Inactive
User Responsibility Access Active
User Access enabled
Form Customization
Filter False+
Data Access Group (Shared Services)
GL Access Limit
Operating Unit Access
Oracle security Profile

remediate SOD
Introductions
SoD Analysis
Case Study
Q&A
Agenda

Access/SOD Policy Management Approach
Detect
SOD/Policy
Violations
Analyze
Violations
Correct
Role
Access
Monitor
Violation
Incidents
Application
Security
Model
Application
Security
Snapshot
Exceptions
Correct
User
Access
App Control Owners/
IS SecurityIS Security/
Audit/Compliance
Control
Owners/
IS Security
Application
Test
Environment
Access AnalyticsRules Manager Action Workflow
Application
Administrator
Approach
Violations ManagerDataProbe ETL
Corrective
Actions
Dashboard
Application
Access
Rules
Roles Manager

System Filters
False+ Filters
Data
Security
Read-
Only
Custom
INV
INV
User
OU
Form
Pro
file
Role
Filters Type Conditions Results Excluded
Inactive User Global End-Date Users
Inactive Role Global End-Date Roles
Business Unit Global Org Name Organization
View Only Local Function Path Functions
Data Security Local Data Group Groups
Personalization Local Form/Page Forms
Approach
Role User
OU

Remove Inherent False PositivesApproach
User Global Conditions to filter “inherent”
False Positives like:
Inactive Users
Inactive Responsibilities
Read-only Access

Filter Conditions can be setup
to exclude SOD violations from
results
Approach Exclude Local Exceptions

Remediate Violations: Remove
User access to Responsibility
Approach Remediate SoD Rule Violations

Create Target Roles to
eliminate SOD Violations
Approach Remove inherent SOD Risks

Fortune 500 Global Manufacturer Improves
Segregation of Duty Controls across multiple ERP instances
Our Client
Fortune 500 company, manufactures and distributes
coatings, specialty materials, and glass products.
Business Runs on multiple Oracle EBS, SAP systems
Over 40,000 employees world-wide
Challenges
Replace multiple legacy systems with one ERP
solution
Improved Segregation of Duty controls within
mission critical applications
Maintain consistent ERP system access roles across
the subsidiaries leveraging the shared services
model
Increase external auditor’s reliance on ERP Access
Controls Monitoring
Solutions
SafePaaS Access Policy Manager
SafePaaS iAccess User Proviosning
Results:
Reduce ERP SOD Remediation time by identifying and
eliminating 80% False Positives resulting in over $50,000
annual cost savings in Audit and Remediation Costs
Created over 100 Segregation of Duty compliant Roles
by business segment with two weeks from FulcrumWay
Role Templates within the controls catalog.
Lowered ERP Total Cost of Ownership by reducing SoD
remediation time and costs by ensuring that all users a
assigned only the pre-approved Roles
Improve SoD and Access Controls testing time by
providing auditors the access log reports showing all
Update, Review and Approve Role design changes.
Accelerated ERP Access Approval time by identifying
valid SOD conflicts before the Roles are assigned to
Users.
Case Study

Sign-up for FREE 30 Days EvaluationQ & A
Register online to try out
SafePaaS

Learn the latest trends and tools to help you id and remediate SOD

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (19)

Similar to Learn the latest trends and tools to help you id and remediate SOD

Similar to Learn the latest trends and tools to help you id and remediate SOD (20)

Recently uploaded

Recently uploaded (20)

Learn the latest trends and tools to help you id and remediate SOD