1. Microsoft Dynamics NAV: Tips and tricks for security methodologies Andy Snook and Nate Boettcher Fastpath, Inc.

2. Agenda Introductions Common challenges Planning Deploying Testing Troubleshooting Auditing

3. Introductions

4. About Andy President of Fastpath Certified in Risk and Information Systems Control 17 years experience in financial management systems 10 years experience in systems auditing

5. About Nate Applications Engineer at Fastpath 5 years experience in software development 3 years experience in Microsoft Dynamics

6. About you Microsoft Dynamics NAV Version Role Security admins Finance Audit Regulatory compliance SOX FDA DCAA LMNOP

7. Common challenges

8. Access security is low priority for the project team Everyone is SUPER! Security is the domain of IT/Sys Admin not BPOs Expensive customisations in place of security Process controls not part of the design No consideration of segregation of duties Dilution of ‘go-live’ security design Inability to report on current security setup

9. Planning

10. Avoid the house that Jack built Implementation and upgrade time is perfect Start with process not with technology Include roles, systems, risks and controls End result is a role matrix

11. Six Sigma Process Map

12. Role matrix

13. Segregation of duties Have a methodology Build rules (email me for ISACA SOD set) Balance preventative vs. productivity Don’t forget about process controls The goal is a blend of security and controls

14. Deploying

15. NAV 2013 Security Model

16. Deploying – Moving from your plan to NAV – Out of the box permission sets – Use as templates – S&R-Q/O/I/R/C – Create sales orders etc. – S&R-Q/O/I/R/C,POST – Post sales orders, etc. – BASIC

17. Testing

18. Utilize your plan from planning stage Have at least one person for each employee type Validate each process for permission errors Troubleshoot any permission errors Rinse and repeat

19. Troubleshooting

20. Manual Application Test Toolset – Code Coverage Tests Easy Security Lite Task Recorder using SQL Sever Profiler

21. Auditing

22. Don’t set and forget Take a risk based approach to reviews BPOs should review access Monitor SUPER access Update processes, rules and matrices

23. Questions? snook@gofastpath.com @snookgofast boettcher@gofastpath.com @nboettcher