This document discusses risk management in role-based applications and segregation of duties in Oracle. It provides an agenda for the topics to be covered, including an overview of common security issues, a top-down approach to security design methodology and its benefits. It then discusses Electronic Arts' Project Meridian, including the background and goals of the security design. The document outlines Protiviti's security design and build process and how automated segregation of duties monitoring can be done using Oracle Audit Analysis and Collection Gateway.
This document discusses risk management in role-based applications and segregation of duties in Oracle. It provides an agenda for the topics to be covered, including an overview of common security issues, a top-down approach to security design methodology and its benefits. It then discusses Electronic Arts' Project Meridian, including the background and goals of the security design. The document outlines Protiviti's security design and build process and how automated segregation of duties monitoring can be done using Oracle Audit Analysis and Collection Gateway.
This document discusses risk management in role-based applications and segregation of duties in Oracle. It provides an agenda for the topics to be covered, including an overview of common security issues, a top-down approach to security design methodology and its benefits. It then discusses Electronic Arts' Project Meridian, including the background and goals of the security design. The document outlines Protiviti's security design and build process and how automated segregation of duties monitoring can be done using Oracle Audit Analysis and Collection Gateway.
This document discusses risk management in role-based applications and segregation of duties in Oracle. It provides an agenda for the topics to be covered, including an overview of common security issues, a top-down approach to security design methodology and its benefits. It then discusses Electronic Arts' Project Meridian, including the background and goals of the security design. The document outlines Protiviti's security design and build process and how automated segregation of duties monitoring can be done using Oracle Audit Analysis and Collection Gateway.
Copyright:
Attribution Non-Commercial (BY-NC)
Available Formats
Download as PDF, TXT or read online from Scribd
Download as pdf or txt
You are on page 1/ 30
Risk Management in Role-based Applications Segregation of Duties in Oracle
Sundar Venkat, Senior Manager, Protiviti Tai Tam, Accounting Manager, Electronic Arts Core Competencies C23
Page 0 of 29
Agenda Introductions Overview and Session Objectives Common Issues in Security Design Top-Down SoD, Security Design Methodology and benefits About Electronic Arts Project Meridian Background and Security Design Automation of Segregation of Duties (SoD) Monitoring using Oracle AACG Automation of Security Build Q&A Page 1 of 29
Introductions Protiviti
Sundar Venkat, Senior Manager Over 10 years of experience in ERP Implementation, Security and GRC Design Electronic Arts
Tai Tam, Accounting Manager Global lead for Segregation of Duties. Over 15 years of experience in the Industry, working in various capacities in Finance, Audit and Compliance Page 2 of 29
TOP-DOWN SoD AND SECURITY DESIGN METHODOLOGY AND BENEFITS
Page 3 of 29
Common Issues in Security Design
Insufficient understanding of the security model of ERP systems leading to a design that is not comprehensive Not allocating enough time in the implementation process for security design Not identifying and securing sensitive data prior to implementation Need to define a lot of manual controls increasing audit cost Page 4 of 29
Understanding SoD Design Approaches
Bottom-up
No direct relationship between formal SoD policies and Oracle Responsibilities. Oracle Responsibilities are defined based on limited design of SoD rules. Oracle Responsibilities are not conflict-free. One-off results in each SoD test cycle. Heavy manual controls. Bottom-up
Page 5 of 29
Alternate SoD Design Approach
Top-down Business process owners define formal SoD policies. These policies are used as the foundation of SoD design in Oracle ERP environment. "Authorized" conflicts are determined at the design level. Oracle functions are classified according to formal SoD policies and rules are defined by business process owners. Conflict-free Oracle Responsibilities are designed according to these policies. Page 6 of 29
Top down
Alternate SoD Design Approach (continued)
Top-down Each Responsibility includes a set of functions defining its unique characteristics. Oracle functions are categorized into Business Setup, IT Setup, and Transactional setup, ensuring consistency in the separation of the functions by category. Good fit for automation. Top down
Page 7 of 29
Security and SoD Design Approach
SoD Policies
Business Rules
SoD Control Automation
SoD Elements SoD Rules Matrix
SoD Rules Library
Oracle SoD Matrix
Business System
Oracle Responsibilities
Authorized Conflicts
Model Users
Real Users
SoD Conflicts Test & Reporting
Page 8 of 29
Example of SoD Design Elements
Procure to Pay Transactions & Master Data Procure to Pay Transaction Elements Vendor Invoice Processing Expense Report Processing Posting to G/L Master Data Elements Vendor Master Chart of Accounts Bank Master Data Tax Master Data Organization Master Data Period-End Master Data SoD Policy Sub-element 2 Vendor Master Chart of Accounts
SoD Policy
SoD Elements
SoD Policy Element 1 Transactional Data Transactional Data
SoD Policy Element 2 Master Data Master Data
SoD Policy Sub-element 1 Vendor Invoice Processing Posting to G/L
SoD Rule Matrix
Oracle SoD Matrix
SoD Policy Element Transactional Data Master Data
SoD Policy Lowest-Level Element Vendor Invoice Processing Vendor Master
Oracle Function AP_APXPAWKB_CHECK_ACTIONS AP_APXVDMVD
Oracle Function Description Payment Actions Suppliers Page 9 of 29
Design Steps Summary
Step 1: Segregation of Duties (SoD) policies of the enterprise are designed. These policies are system agnostic. Client's business stakeholders provide feedback if SoD policies are relevant and if they represent risks that need to be monitored. Step 2: SoD Elements and Rule-set are designed based on SoD policies defined in Step 1 above. An SoD Rule comprises two policy elements that are conflicting in nature. Page 10 of 29
Design Steps Summary (continued)
Step 3: The Oracle SoD Rule-set represents Oracle Functions and is used as a basis to design the Oracle Responsibilities and Request Groups. Step 4: Responsibilities are designed in such a way that conflicting elements are not defined within the same responsibility. Page 11 of 29
Benefits Provides a business view of Oracle Responsibilities and uses business-user friendly language. Oracle Functions are grouped into a brief list of business activities. The Design templates provide easy drill-down to Oracle Functions from business activities. Custom Responsibilities and Request Groups are designed based on business activities. The Design includes Responsibility and Request Group matrices showing SoD conflicts. Page 12 of 29
PROTIVITI'S SECURITY DESIGN & BUILD PROCESS
Page 13 of 29
Process Flow Design Oracle Responsibilities
Page 14 of 29
Automated Responsibility Build using proprietary tool
The tool uses the System Administrator User interface on Oracle E-Business Suite to build responsibilities. No transactions are performed on the database (back-end). This minimizes risks of data inconsistencies when moving responsibilities from one environment to another. 'Custom' responsibilities are built using the concept of menu and function exclusions, not customizing seeded responsibilities. Pre-defined 'Built' templates available for various releases of Oracle E-business Suite. Tool processes large volumes of transactions in a few hours. Page 15 of 29
Examples of pre-defined templates include: Exclude Menus and Functions
Automated Responsibility Build using proprietary tool (continued)
Build 'Custom' Responsibilities and 'Custom' Menus
Assign seeded request groups to responsibilities
Assign Custom Reports, Forms and Functions to responsibilities
Assign FND Profile Options to responsibilities Assign Security Profiles to responsibilities Assign Multi Organization Access Controls (MOAC) Assign Inventory Organizations to responsibilities Page 16 of 29
Process Flow Build Oracle Responsibilities
Page 17 of 29
CASE STUDY: PROJECT MERIDIAN ERP TRANSFORMATION TO ORACLE R12
Page 18 of 29
Project Meridian is Part of a Larger Effort
Earlier Transformation Projects (COA, Global Planning, P&L/Reporting, Product MDM, GPO Supply Chainrelated) COA Oracle 11i US Oracle 11i Europe Oracle 11i Asia Oracle 11i Global Oracle R12 Oracle Middleware
Tibco Middleware EA Infra EA Infra EA Infra EA Infra
Oracle Infrastructure
Phase 1 Deploy following Oracle modules in R12 Procurement: iClick + iExpense & iProcurement Finance : General Ledger, Accounts Payable, Indirect Purchasing, Fixed Assets Phase 2 Deploy following Oracle modules in R12 Publishing : Inventory, Order Management, Pricing, Supply Chain Finance: AR, Trade Management, Advanced Collection, Costing Online Publishing (Digital Order to Cash)
Meridian
Meridian will switch primary focus to revenue generation processes
Page 19 of 29
Project Meridian Objectives
Global Single Instance Global Business Process Standardization Achieve Operational Efficiency Minimize Customization Minimize Development Cost Cost Efficiency Page 20 of 29
Project Meridian Security Design Objectives
Design SoD Rule-set to address risks in new Oracle R12 modules
Minimize SoD Risks on Oracle R12 custom responsibilities using the SoD Rule-set as a basis Page 21 of 29
ORACLE SECURITY DESIGN & AUTOMATED SoD MONITORING
Page 22 of 29
Automated Monitoring of SoD Using AACG
1 Identify and rank SoD risk with various Oracle access scenarios in key business process areas. Financial Close Process General Ledger Procure to Pay Process AP, Purchasing and Fixed Assets Order to Cash Process AR, Pricing, Customer Master and Sales Invoicing # 29 30 31 32 33 37 38 39 40 41 42 Process Procure to Pay Procure to Pay Procure to Pay Procure to Pay Order to Cash Order to Cash Order to Cash Order to Cash Order to Cash Order to Cash Order to Cash SoD Rule Descriptions Supplier Master; AP Payments Supplier Master; Payables Invoice Entry; AP Payments Supplier Master; Purchase Order Entry; Receiving Transactions Supplier Master; Requisition Entry; Receiving Transactions AR Approve Adjustments; AR Cash Receipts AR Approve Adjustments; Sales Order AR Approve Adjustments; Sales Pricing AR Cash Receipts; AR Customer Master AR Cash Receipts; AR Debit Memo AR Cash Receipts; AR Sales Invoicing AR Cash Receipts; Sales Agreements FY11 Rankings Low High High High Moderate Moderate Moderate Moderate High High Low
Page 23 of 29
Automated Monitoring of SoD Using AACG (continued)
2 Develop SoD rules with applicable Oracle functional elements covering the Oracle access scenarios and build them in AACG.
Page 24 of 29
Automated Monitoring of SoD Using AACG (continued)
3 Set up the AACG Global Conditions and Global Path Conditions to automatically exclude certain operating units, responsibilities, users or functions from being included in the conflict analysis. Run AACG conflict analysis on selected key SoD rules to detect SoD violations on a regular basis (e.g., quarterly or annual).
Page 25 of 29
Automated Monitoring of SoD Using AACG (continued)
5 Analyze the conflict extract reports to eliminate false positives and identify true intra and inter responsibility conflicts. Work with the business owners to determine proper remediation actions such as remove certain functions from the responsibilities and/or change the user assignments.
Page 26 of 29
Benefits from Monitoring SoD Using AACG
AACG provides an auditable framework and process for SoD control Automated process in assessing SoD conflicts raises confidence level of the external auditors Discover SoD conflicts related to hidden functions which manual reviews won't likely detect SoD rule-set provides solid guidelines for business owners to consider when approving user access SoD rules can be set up with any combination of functions or access points to fit different business scenarios Detect any type of conflicts at any time Page 27 of 29
Benefits of Automated SoD Monitoring Using Oracle AACG
Policy Listing
Stores a repository of SoD rules for Oracle Ebusiness suite across Financials, Procure to Pay, Order to Cash, Human Resources, etc. Identifies SoD conflicts based on Oracle ERP environment Provides the ability to configure exceptions
SoD Detection Authorized Conflicts
Reporting
Detects what access users have and what users can do; generates conflict reports for both within Oracle responsibility and multiple responsibilities assigned to users Acts as an effective monitoring tool and helps prevent fraud by limiting what users can do Page 28 of 29
