Segregation of Duties

IT_Prof

Member
Our company currently administers security via menu masking. Little action code security exists, except on 'critical' programs. My question is: what's the best way to identify possible SoD issues when menu security is used? Are there certain reports that can be used to determine if someone has dual access to certain programs?

Also, is there any type of report that will show which form and row exists have been enabled/disabled from each program? These of course, allow access to 'unauthorized' areas and need to be looked at when identifying possible SoD issues.

Thanks in advance for any help!
 
Hello IT_Prof,
This menu security way is not very secured. You can run any report using a command line, for example.

Alex-admin
Sun, Oracle, XE
 
We've developed custom reports for each security area (row, action, application, etc..) in a matrix format (groups as columns and objects as rows) for annual review.

Our model is to deny access to *Public and then grant privledges back. We also review the applications is use and remove right to row exits which allow people to delete, reverse, etc by default and re-grant where appropriate.

You may want to revisit how your security model is defined since menu security is loose and tighter control are necessary to meet Sarbanes Okley and just good business

Sue
Xe update 6, sp18.1 Oracle, NT
 
I am trying to generate similar reports for user access. I want to make sure there are proper segregation of duties, but I am trying to generate a report that isn't 1000 pages long. Any help on how you created this cross tab report would be appreciated.
 
We are implementing a menu masking strategy as well. As long as you hit the right areas, you can have an "all doors open" approach that is just as secure as "all doors shut" yet somewhat easier to maintain. Take away fast path and lock down all sensitive apps first like security and tax id numbers. Then what we did was get screen shots from the functional managers with what row exits and form exits in each application were needed. Snaking down until there were no more exits. We then applied app secuirty to take away that app from that group and applied action security on the app they exited into for AddChangeDelete or Inquiry only. Qsoftware is a neat program that can help with implementing this security as well and turns out it can help with an "all doors open" approach too. Hope this helps.
 
Dear IT Prof,

Our experience is that "Menu Security is NO Security". There are so many back-doors to programs that you can not rely on menus to stop people getting to them. Because of this you will not be able to produce a reliable report. We have gone "Deny ALL" so that users do not have any access unless it is explicitely granted to them. We ended up buying QBuild from Q Software. Their product enabled us to go Deny ALL very easily. I think I still have some of their literature if you require it.

OneWorld XE
 
We looked at a number of options and ended up obtaining a security and SOD service from a specialised vendor. The price was low, turn around was fast and the deliverable more than met our needs. We are potentially looking at this service on an annual or biannual basis and our auditors can accept their work.

IMHO, it's easier and cheaper to outsource than do yourself.

For specifics you (or anyone else interested) can send me a private message.

Regards,

Nick
 
Forgot to mention. We, like many, use QSoftware products for OW. The security and SOD analysis service also included a review of security on QSoftware objects. Price was in the four figure range (USD).

Also, what ever you decide to do make sure your internal auditors agree with your approach.

Regards, Nick

PS I am not associated with the vendor, just a very satisfied customer.

Re: SOX, SOX404, Sarbanes, Oxley, Segregation Of Duties.
 
Did you find that QSoftware reduced your security admin and setup time by the 80-95% as the vendor proclaims in selling material?
Or is it just a "nice to have" product? I'm just trying to get a feel on the real experience and time/costs reduction customers are seeing with this software. Regards.
 
We considered buying QSoftware for the same reason but due to the way it is
licensed (per user) it quickly became unfeasible. Our security person did
heads down setup remotely (so she could be left alone) for two weeks and got
us setup from a 'restrict everything and grant back' approach.





S. Todd Rorie
Technical Manager
Enterprise Business Systems
Enterprise Services
Information Technology Services
Metro Nashville Government
(615) 862-6300 Ext. 77704
(615) 880-1618



_____

From: eddie [mailto:[email protected]]
Sent: Wednesday, July 21, 2004 1:13 PM
To: [email protected]
Subject: Re: Segregation of Duties


Did you find that QSoftware reduced your security admin and setup time by
the 80-95% as the vendor proclaims in selling material?
Or is it just a "nice to have" product? I'm just trying to get a feel on the
real experience and time/costs reduction customers are seeing with this
software. Regards.

OW XE SP18.1 Update 4 Win2000 DEP AS400 V5R1 CO on DB2 ENT Citrix XPe & JAS
2000 users



_____


The entire <http://www.jdelist.com/ubb/showflat.php?Cat=&Board=> JDELIST
thread is available for viewing.



This is the JDELIST EnterpriseOne Mailing List.
The instructions on how to unsubscribe from any JDELIST mailing list are
available here <http://www.jdelist.com/unsubscr.shtml> .
JDELIST is not affiliated with JDEdwards(r).
 
I believe we got that kind of time savings, but due to the way that it helps structure security we have saved time in the maintenance also, which was a bind for us.

At the end of the day it depends on your setup, the guys at Qsoft helped us with quantifying time savings by showing us how many security parameters we would be working with in the standard workbench against how many using QSoft.

We then had to quantify this time saving against our internal costs, I think this method obviously justifies the cost but takes it beyond being a 'nice to have.'

Hope this helps

OneWorld XE
 
I have to agree with peoplesoft321 on this topic. Another draw back to the "All doors open" approach is Sarbanes Oxley compliance. If you are using this strategy, you will find it very difficult to pass their audit. There are too many programs that are left open and can be accessed by exit or form buttons that the segregation of duties can not be cleary defined.

You may save a lot of time using this approach for initial setup, but the pain it will cause later is not worth it.

Also, we too use QSoftware and if you do a good cost analysis, you should find that it does pay to purchase a product like this. A simple "total cost of QSoftware divided by total users" to get a per user cost is not a deep enough analysis.

Dear IT Prof,

Our experience is that "Menu Security is NO Security". There are so many back-doors to programs that you can not rely on menus to stop people getting to them. Because of this you will not be able to produce a reliable report. We have gone "Deny ALL" so that users do not have any access unless it is explicitely granted to them. We ended up buying QBuild from Q Software. Their product enabled us to go Deny ALL very easily. I think I still have some of their literature if you require it.

OneWorld XE
 
Back
Top