sapbiz presentation-security compliance tools
DESCRIPTION
SAP SecurityTRANSCRIPT
1
SAP Security and Controls
Use of Security Compliance Tools to Detect and Prevent Security and
Controls Violations
2
Agenda• Increased Focus on Security & Controls• SAP R/3 Security Risks & Controls• Security Management• Security Compliance Tools• Questions
3
Increased Focus on Security and Controls
• Fraud (Barings Bank,WorldCom, Enron,...)• Security Breaches (UCs, BC, Stanford...)• Regulatory Compliance
• Sarbanes-Oxley (SOX)• Family Educational Rights and Privacy Act
(FERPA)• Gramm-Leach-Bliley Act (GLBA)• Health Insurance Portability and Accountability
Act (HIPAA)
4
Security Risks• Access Control
• Do some users have too much access?• Sufficient access restrictions to private
information?• Segregation of Duties (SoD)
5
Security Compliance Tools – Internal Controls
• “Internal Controls are processes designed by management to provide reasonable assurance that the Institute will achieve its objectives” (From MIT’s Guidelines For Financial Review and Control)
• Cost of implementing control should not exceed the expected benefit of the control
• “Security is a process not a product”
6
Security Compliance ToolsWho has access to
sensitive transactions?Are there any
SoD violations?
• Real-Time Monitoring• Remove access or assign mitigating controls• Reduce time and effort when providing
information to auditors• Used during implementation of new modules
7
SoD Rules Matrix• Predefined SoD Rule Set
• Can Add Custom Transactions to Rule Set
8
Virsa-Compliance Calibrator
9
Virsa-Compliance Calibrator
10
Virsa-Compliance Calibrator• Resolve SoD Issues
11
Security Compliance Software Vendors
• Virsa• Approva• Oversight Systems• Big 4 (E&Y, PwC, KPMG, Deloitte)
12
Benefits of Security Compliance Tools - Summary
• Run with SAP R/3• Automate SoD analysis• Automate monitoring of critical
transactions• Quick assessment of authorization
compliance for business users, auditors, and IT security staff
• Used during development/project efforts• Avoid manual analysis and false positives
13
Questions