Shooting The Moving Target…… Internal Controls & Segregation of Duties (SOD) Session Code: 503 Jasvir Gill, Virsa Systems Donnie Looper, Eastman Chemical Company Kathy Landers, Rockwell Collins

Goals of this session: Shooting The Moving Target Typical SOD Scenario Key SOD/Controls Challenges SOD a Moving Target SOD/Controls Solutions Ongoing SOD/Controls Compliance Questions

Shooting The Moving Target Violating so many controls? This is ugly … Why can’t you ever get your act together?? Users Auditors Management Security/Controls Team I need SAP_ALL Why don’t you let me do my job? Damn it!! I need XK01 now! ASAP!!!

Typical SOD Scenario: Shooting The Moving Target Security implemented as an afterthought Lack of time to address SOD/Controls right from the outset Lack of understanding (and tendency to avoid issues) results in generous authorizations & more SOD issues

Typical SOD Scenario (continued): Shooting The Moving Target External Auditors run utilities, report SOD issues (mostly low hanging fruit) Security Team’s common defense; situation not as bad,looking at object level Some action items to satisfy management

Typical SOD Scenario (continued): Shooting The Moving Target Most fixes (s_tabu_dis,s_program…) No preventive SOD maintenance Companies wasting tons of money on expensive audits and consultants Problems/issues just don’t go away

Common Misconceptions: Shooting The Moving Target We trust our employees Our system is clean (Our programs, tables are protected & password is 5 characters!) We have external audits every year We are different & we have no risk We don’t have time/resources to worry about SOD yet, we will handle it later

Common Challenges: Shooting The Moving Target Defining (finding) good SOD Rules –Significant effort for building & customization –SOD at Authorization Object level (too many permutations & combinations) Defining & Documenting Mitigating Controls –Mitigating Control Approvers –Mitigating Controls Monitors –Mapping to Users/Roles, SOD Rules

Common Challenges (continued): Shooting The Moving Target Adhoc or home-grown Solutions –Incomplete functionality –Not fully automated –Don’t work with online data –Can’t keep pace with SAP SAP Security is complex Poor training –Authorizations Made “Difficult” –SOD/Controls Made “Difficult”

Shooting The Moving Target Phase Cost Most of the clients detect SOD issues here Definition Development Testing RISK FOR FRAUD Production Role Owner User Role Owner Security Admin End Users Auditors Role Owner Security Admin The later you resolve the problem, costlier it will be.

Key Challenge: SOD a Moving Target…. Shooting The Moving Target Constantly changing – Roles – User Access – SOD Rules – Mitigation Controls SAP Releases (3.1I…4.7) New Modules (e.g HR) Laws & Regulations

SOD/Controls Solutions: Shooting The Moving Target Well designed Process & Strategy –Rule building/upgrade methodology –Security/Controls Process Reengineering Who will define Mitigating Controls Who will approve, monitor Mitigating Controls Proactive SOD checks during User Access & Role changes –Training for all players including Role Owners

SOD/Controls Solutions (continued): Shooting The Moving Target SOD/Audit Tool –Comprehensive functionality/reports –Complete automation (including Simulation) –Analysis on live data (even SU24 checks) –Analysis at the earliest phase possible –Appropriate change management capabilities (e.g. for Rules) & access levels

SOD/Controls Solutions (continued): Shooting The Moving Target SOD/Audit Tool –Collaborative features (for all key players) –Reports with complete inside picture –All issues elimination in one cycle –User,Role,Profile,Composites,Job,Position.. –Easy to maintain & use

SOD/Controls Solutions (continued): Shooting The Moving Target Additional Features/Functionality –Automate building Rules –Automate upgrading Rules –Supplementary Analysis –Complimentary Utilities e.g. Validate Controls –Dynamic Rule selection for analysis – Negative SOD Testing

Ongoing SOD/Controls Compliance: Shooting The Moving Target Simulation (“What If” Scenarios) Must be real time, online with live data Fully automated For all changes (Roles,Users,Profiles etc) Available in all environments Available across Environments

Critical Success Factors: Shooting The Moving Target Optimum Rules Powerful Tools Sound Processes & Methodology Proactive ongoing SOD Compliance to reduce day-to-day maintenance & eliminate reinvention of the wheel Networking (Best Practices)

If you wish to contact us: Shooting The Moving Target Jasvir Gill: Donnie R. Looper: Kathy Landers

Questions: Shooting The Moving Target

Thank you for attending! Please remember to complete and return your evaluation form following this session. Session Code: 503