Segregation of Duties
•
5 likes•3,123 views
This presentation has been delivered by Karl Schleps & Holger Schrader at the PECB Insights Conference 2018 in Paris
![2
Organizational Resilience
What is Organisational Resilience?
The emergence of several disruptive trends (e.g technological
discontinuities, regulatory upheavals, geopolitical shocks, [..]
abrupt shifts in consumer tastes, and hordes of nontraditional
competitors) that require companies to become resilient to
remain successful.](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Segregation of Duties
Similar to Segregation of Duties (20)
More from PECB
More from PECB (20)
Recently uploaded
Recently uploaded (20)
Segregation of Duties
- 1. Segregation of Duties and Dual Controls related to Organizational resilience roles Karl Schleps / Holger Schrader Partner at Enfina - Security
- 2. 2 Organizational Resilience What is Organisational Resilience? The emergence of several disruptive trends (e.g technological discontinuities, regulatory upheavals, geopolitical shocks, [..] abrupt shifts in consumer tastes, and hordes of nontraditional competitors) that require companies to become resilient to remain successful.
- 3. 3 Organizational Resilience What is Organisational Resilience? Experts also stated that organizational resilience marries risk assessment, information reporting, and governance processes with strategic and business planning to create an enterprise- wide early warning capability that is embedded in the business of the company.
- 4. 4 Organizational Resilience What is Organisational Resilience? Enterprise Resilience is predicated on an expanded view of risk… focuses on value and therefore encompasses not only traditional risks (e.g., financial, natural hazards, physical security, legal, compliance) but also risks relating to earnings drivers (e.g., innovation, channel relationships, intellectual property) and company culture.
- 5. 5 Organizational Resilience What is Organisational Resilience? The US President issued Policy Directive Eight (PPD-8) (31.03.2011)[defined resilience as the ability to adapt to changing conditions and withstand and rapidly recover from disruption due to emergencies. Focus on Security Protection Crisis management Preparedness Risk management Source: Wikipedia Earning Loss Time exceeded Chance Best Case Szenario Risk Worst Case Szenario Scenario Funnel
- 6. 6 Org - Unit C Org - Unit B Org - Unit A Sub Process V Sub Process IVSub Process III Sub Process II Segregation of Duties What is Segregation of Duties? In a functional organization, Segregation of Duties (SoD) is the organizational separation between organizational units or positions in the business process to avoid possible conflicts of interest. Source: Wikipedia Business Process Sub Process I
- 7. 7 Segregation of Duties Segregation of Duties – around us! The separation of state and church began in Europe in the 16th century. (Hobbes, Voltaire, Rousseau). The separation of powers into legislative, executive and judiciary is a fundamental component of democracy. SoD was already implemented in companies long before the legislator or regulatory organizations arrived at SoD.
- 8. 8 Segregation of Duties What is the focus of Segregation of Duties? SoD is an essential, but small part of information security. There are the following aspects in protection of Information: (C-I-A triad) Confidentiality (Need-to-know; Not in scope of SoD) Rules that limits access to the information Integrity (4-eyes principle; Main focus of SoD) Assurance that the information is trust- worthy and accurate Availability (Redundancy principle, not in scope of SoD) Guarantee of reliable access to the infor- mation
- 9. 9 Segregation of Duties Regulatory requirements have only been formulated in recent decades based on the experience with individual misconduct. ISO Minimum Requirements for Risk Management (MaRISK) Directives of regulation authorities … > 190 requirements located … SoD is a regulatory and legal requirement …
- 10. 10 Segregation of Duties … not only – it is a key component of an effective risk management system Preventive measures • avoid conflicts of interests • detect control errors • reduce risks like misconduct, fraud, misuse, errors • avoid bypassing security controls. • Hidden & incalculable (consequential) costs • Shareholder Value - Losses • Fines and compensations • Downgrade • Rising refinancing costs €
- 11. 11 Mitigation & Remediation of SoD Conflicts INTRA - SoD conflicts: SoD conflicts arise within an application or an authorization role INTER - SoD Conflicts: SoD Conflicts arise for the User Temporary settlement conflicts: • Additional control measure • Exemption (3/6 months, perm.) • Assumption of risk • Temporary derogation rule for further analysis Permanent cleanup conflicts: • Cleaning of roles and permissions • Withdraw rights • Organizational adjustments • Modification of business processes
- 12. 12 Mitigation & Remediation of SoD Conflicts Dual Control or Two-Man Rule The Dual Control (also four-eyes principle) is a control mechanism designed to achieve a high level of security for especially critical processes and functions. Under this rule all access and actions require the presence of two authorized people at all times: Dual control by 2 (physical) persons (users) Software built-in dual control solution Dual control/four-eyes principle by system controlled solutions Dual control/four-eyes principle by randomized controls Post-controls
- 13. 13 Segregation of Duties A proper implemented and audit provable Segregation of Duties process requires … • Policies, procedures, … • Documentation of processes • Control plans • Risk-compensating measures • Operational functions • IT resources (software, access concepts, permissions) • Data model • Data classification • … In addition: • Processes of SoD exception handling ? ? ? ? ? ? ? ? ? ? Updated? Complete? Checked? Working? http://www.live-karikaturen.ch How to do?
- 14. 14 The solution and the „how to“. The SoD Solution Model by Functional Separation! • Access rights (entitlements) assignments. (Source: Centralized Access Management) • Entitlements mapped to business functions. (Source: Business Process Documentation) • Incompatible business functions (“toxic combinations”) within one business process. (Source: Legal/Regulatory Requirements) • Tools (Source: Ready-made vs. self-made solutions) http://www.live-karikaturen.ch
- 15. 15 SoD Control (detectiv & preventiv) Org - Unit C Org - Unit B Org - Unit A Sub Process V Sub Process IVSub Process III Sub Process II The solution and the „how to“. The SoD Solution Model by Functional Separation! Business Process Sub Process I Function 1 Function 2 Function 3 Function 4 Function 5 Entitlement A Entitlement B Entitlement C Entitlement D Entitlement E
- 16. 16 The reason why to do so! • Detached from organizational structure and location • Top down (= renew) or bottom up (=analyze) vs. “side-in solution” • Scaleable & flexible rule framework • Shrinkage to BCM-relevant (core) business processes remains SoD covered due to focusing on function http://www.live-karikaturen.ch
- 17. 17 “Amat victoria curam” Our Thesis - Our Solution Organizational Resilience increases with the independence of the business processes from organizational structure!
- 19. 19 Backup
- 20. 20 Banking Industry Architecture Network Service Landscape 4.0 1) https://static.bian.org/wp-content/uploads/2015/07/BIAN_landscape4.0.pdf
Editor's Notes
- Security Security, whether applied to physical, financial, personnel, cyber information or any other asset, entails the measures to protect against danger or loss with emphasis on being protected from dangers that originate from outside. A significant breach in security could certainly impair an organizations ability to exist, and thus is a critical concept underlying the organization’s capacity to be resilient. Resilience is proactive in positioning the company to survive and thrive given known and unknown challenges. Security, as generally practiced, provides specific protection against identified or projected circumstances. Protection Protection is often associated with the set of actions to harden assets to withstand identified contingencies, mitigate the damage, or make them an unattractive target. The focus is to maintain the assets’ core function and ward off harm. Typically, protection performance objectives are stated as an absolute capability against varying levels of threat (category II or greater hurricane, defined types of breaches, specific acts). Organizations plan for protection against specific threats or categories of threats. Resilience approaches the issue from a standpoint of taking reasonable protective actions, but having alternative capabilities as needed or the ability to withstand the disruption. Crisis management Crisis management generally refers to the set of actions and capabilities in place to effectively respond to and contain a situation. The situation can vary from natural, man-made, or environmental challenges, whether internally or externally generated. Most consider crisis management to largely consist of actions that go into play when the crisis occurs and subside after it is considered “over”. There are plans and preparations, but the actions are not often dealt with as part of normal operations. Resilience depends on effective crisis management, but would encourage more prominent treatment of crisis management capabilities throughout the company’s operation than is often the case. Preparedness Preparedness consists of the plans of actions for when the disaster or crisis strikes. Preparedness efforts are very specific sets of tactical actions (evacuation plans, sheltering plans, rehearsals, stockpiles, etc.) that the company and individuals will take to mitigate the effects of predicted disasters/crises. Resilience requires prudent and serious attention to preparations for known likely disasters, particularly those that are highly likely (e.g., hurricanes in Florida). Resiliency would address preparedness as a specific emergency management business function; but more importantly, as being impacted by numerous functions across the organization. These may include human resources, strategic planning, financial management, information technology, and risk management. Risk management Risk management consists of formal processes to identify threats and vulnerabilities to the company, and the mitigation approaches it will employ. Risk management is highly sophisticated and the results have application in managing the business, insurance coverage, and in attracting investors. The risk management profession is moving toward a more proactive and return on investment focus, but the traditional focus has been defensive in nature. Identifying and managing risks, particularly operational risks, is arguably the most important factor in achieving resilience; however, it is one of many factors. Resiliency has a healthy consideration of posturing for future opportunities. That is not a traditional consideration in risk management