Blog

Now think of a staff member that can open the supplier account, add an invoice, and check off the payment. If the employee is not going to commit any crimes, it is the company that is putting itself at risk because it is giving one person control over all aspects of the job.

This is one of the issues that organisations aim to avoid when implementing segregation of duties – or SoD for short. A concept of major importance in SAP security and governance is that users require access to complete their work, but do not necessarily have the authority to complete all the tasks in a business process.

If you are thinking about taking SAP GRC Security Training in Bangalore, you will find it helpful to understand how threats to access are identified and managed, as it gives you a real-world example of how governance, risk and compliance are managed in SAP systems.

Why Companies require Segregation of Duties?

In a business system, various employees are responsible for various things. The purchase order can be written by one, the order signed by another and it can be paid by a third.

Having these roles divided makes it easier to see any errors, to see if any transactions have been approved that shouldn’t have been and to track who is using the card.

Issues may occur if a user is given the permission to do conflicting actions. For instance, a user who can create a supplier and approve the payment from that supplier will have the chance to bypass the normal check.

Not all employees need to have only one permission. It implies that sensitive duties are allocated based on organisation policies, business needs and risk appetite.

What is Sap Grc Access Risk Analysis?

Access risks and access compliance processes can be managed with SAP Governance, Risk, and Compliance (GRC). Access Risk Analysis is a feature of SAP Access Control that is used to determine the access risks of users, roles and authorisations.

An organisation usually has rules defining sets of accesses that are deemed to be risky. If the user gets a role and/or more permissions, the access that is granted can be compared to the rules.

An access-risk rule, for instance, could detect a problem when creating supplier master data and processing payments. The combination of the same user with both activities can be marked for review if the user has both.

It is not meant to imply that the employee has been in error. The goal is to detect a potential risk in advance of it becoming a control issue.

What is an Access Risk Review?

There are several steps to a typical access-risk review. The exact procedure will depend on how an organisation’s SAP GRC is configured and the security policies in place.

1. To understand the employees’ job responsibilities.

The first question for the review is simple: What does the employee need to do?

A finance employee might need to view invoices, account paperwork and make some postings. As part of the purchasing process, one employee might need to keep track of purchase orders and verification of supplier information.

It assists the security team to understand what is legitimate access and what has no need for extra privileges.

2. The Assigned Roles is reviewed

Authorisations for SAP users are provided via roles and access assignments. A permission can be granted to a role for multiple transactions or business activities.

Security team assesses the effective access based on the roles assigned to the user. This is not sufficient to understand a role name as it is the actual permissions which determine what the user can do.

It is an important learning point for students that access-risk analysis relies on the authorisations and the set of risk rules.

3. Run the Access Risk Analysis

Analysis is conducted to see if their use is consistent with the defined risk conditions. Depending on the configuration, the review may be able to find conflicts of segregation of duties and/or critical access that requires special attention.

Assume that a user already has permissions to create suppliers. If a new role is added that provides access to payment processing, then the combined permissions may result in an SoD conflict that wasn’t present previously.

This conflict should be identified at the time of assigning roles and/or during periodic review, affording the organisation a chance to assess the risk.

4. Evaluate the Finding

Not all findings warrant the same response. The security team should be aware of the business activities that are involved, the use of access, and the level of risk severity in line with company policy.

A finding can be addressed by stripping away excess permissions, redesigning a role or by splitting up conflicting roles among employees.

Where the business really requires to have conflicting access, the organisation may wish to consider an approved mitigation control, which is supported by policies and procedures.

5. Record and track the resolution

To close an access-risk finding is not just about role changes and moving on. The decision, the approval, corrective action and any mitigation controls should be recorded by the relevant team.

Periodic reviews are also essential as employees change jobs, projects come with new requirements and temporary permissions may be in effect beyond the time specified.

A documented review will allow the organisation to establish that access risks are not just being logged, but are being managed.

A case study pertaining to Practical SAP GRC students.

Assume that the company has two employees assigned to creating supplier records in one and processing payments in the other. The company is concerned that no one is able to take control of both of the activities without an exception.

In an access review the SAP security team finds out that the first employee has been granted an extra finance role. Access Risk Analysis detects a possible conflict of interest.

Then the team verifies the permissions which caused the conflict. The role assignment may be amended by the approval process in the organisation in case the payment related access is not necessary. If necessary for a valid business reason, the company will consider an appropriate mitigation control.

This example illustrates the relationship between the technical access control and the business control requirements in SAP GRC. It also shows why security professionals should be aware of both SAP authorisations and the processes that they enable.

What should be taught to students in SAP GRC Security Training?

A programme should address how SAP security, access management and governance controls relate.

Opportunities for useful learning should involve:

• An introduction to SAP GRC basics and the role of Access Control.
• Concepts of users, roles, profiles and authorisation.
• Access-risk terminology and segregation of duties.
• Be familiar with concepts of Risk Analysis and risk-rule.
• Processes for user access reviews and role assignments.
• Risk remediation and risk mitigation controls.
• Emergency access management concepts (if applicable in the syllabus).
• Easy trouble shooting, documentation, and compliance scenarios.

The specific syllabus may vary from product to product and provider to provider. Verify, before enrolling on any course, whether there are practical demonstration and exercises which cover access-risk findings.

Who can do the SAP GRC security training in Bangalore?

Graduates, SAP security learners, system administrators, IT auditors, security compliance professionals and consultants may find this subject to be of interest because they want to know how organisations manage access to business systems.

It helps to have a basic understanding of the concept of SAP roles, transactions and authorisations Those who are new at security can also start with the basics of security and proceed with the processes of GRC.

Students should practise as they prepare for a career, providing examples of why a particular permission is a risk, how this risk can be investigated and what corrective action may be appropriate. These abilities allow for more value than just memorization of terms without learning the business reason behind them.

Learning SAP GRC Concepts with Version IT

While studying SAP GRC Security Training Course in Bangalore at Version IT, students can inquire of the training topics, practical’s offered and the SAP GRC environment that was demonstrated.

Take a shot at seeing if you can understand an access-risk scenario from end-to-end (what activities are competing for access, what permissions are granted, what risk finding is done, etc., and what access-risk resolution/mitigation might look like).

Students will have examples like this to help them understand SAP access governance and will be able to participate in discussions about security scenarios in a job interview.

Final Thoughts

There is a principle of segregation of duty that plays an important role in access control in business systems. It enables organisations to assess and understand where one user is overly controlling activities they are connected to, and provides a structure for security teams to investigate those risks.

If you are thinking of taking the SAP GRC Security Training in Bangalore, then it is advisable to learn about Access Risk Analysis using real business scenarios. Understanding access risks, how to assess them, document them and then deal with them, can help students gain a better understanding of SAP governance and security processes.