topic Re: Need Help from Gurus on Role Redesign in Application Development and Automation Discussions

Need Help from Gurus on Role Redesign

Former Member — Fri, 21 Dec 2012 15:46:34 GMT

Hello SAP Security Gurus-

I need your help-

I hav been given a project to redesign of existing roles to create job-based roles for FICO,SD,MM,module to decrease segregation of duties conflicts among users as well as allow for flexibility as the organization changes.

Help me on how i proceed on this task.

Thanks

Uttam

Re: Need Help from Gurus on Role Redesign

Former Member — Fri, 21 Dec 2012 16:25:49 GMT

Hello

What have you put into your plan so far?

Cheers

David

Re: Need Help from Gurus on Role Redesign

Former Member — Fri, 21 Dec 2012 17:07:41 GMT

Hello

what is the current role structure that your organization follow?

Re: Need Help from Gurus on Role Redesign

Former Member — Fri, 21 Dec 2012 21:50:23 GMT

Hi, with the greatest respect isn't this what your client is paying for you to know? At least post up the salient facts to give us a bit of background.

Cheers

Re: Need Help from Gurus on Role Redesign

Former Member — Fri, 21 Dec 2012 22:18:23 GMT

I still have 1 hour and a bit to go without the world ending, so can the guru please confirm that it is safe on the other side, or does it all look like this post?

Cheers,

Julius

Re: Need Help from Gurus on Role Redesign

Former Member — Fri, 21 Dec 2012 22:36:50 GMT

Hi Julius,

The "World Ending" was postponed due to a system error lol.. So every one is safe. Its time to plan for the Xmas holidays now. Wishing you and the team a very great XMas.

@Uttam - There are numerous ways that can be followed to re-design the roles. It would be better to recommend the possible approches when you provide all the required information. If you have a SoD tool (RAR or any other SoD tool), you may use the simulate option before actually adding the transaction code(s) is the role(s).

Further, as a quick recommendation, try to have a quick discussions to map the various business processes into roles. This way you can reduce the intra level violations.

Happy Christmas to you too..

Best Regards,

Raghu

Re: Need Help from Gurus on Role Redesign

Former Member — Mon, 24 Dec 2012 08:28:36 GMT

Thanks Raghu for your advice..

Re: Need Help from Gurus on Role Redesign

Former Member — Mon, 24 Dec 2012 09:30:22 GMT

Thank you Alex.

Redefine roles (AP, AR, FI-CO, GL, MM, SD) to create a more flexible platform which may adapt to organizational changes
a	Create "base" roles comprised of view accesses
b	Create "report" roles comprised of reports
c	Create "task" roles aligned with SAP "functions" for write access

This is the requirement.

Re: Need Help from Gurus on Role Redesign

Former Member — Wed, 26 Dec 2012 09:40:17 GMT

Hello Raghu-

I am new to this company and this is something new for me,

When i check the SAP roles in the system, its currently messed up as lot of users have access to critical tcodes to do malpractices, Business says thats fine to have, but internal controls team says that users cannot have such access, so issue is that we cannot remove current access of users as the business would get impacted.

Internal Controls team wants to Redesign the current roles existing in the system.

Can you help and guide me on how i go ahead with this assignment.

Any help is much appreciated!

Thanks

Uttam

<telephone_number_removed_by_moderator>

Re: Need Help from Gurus on Role Redesign

Former Member — Wed, 26 Dec 2012 10:14:17 GMT

Hello Uttam

As per your post what i feel is that the role structure defined and the access that ur users holds are beyond what it is required and used by them .

Can you tell Whats the User strength?currently how many users that u gv support for ..?so that can suggest u accordingly..

Re: Need Help from Gurus on Role Redesign

Former Member — Wed, 26 Dec 2012 10:39:57 GMT

Hello John,

yes you are right John the role structure is not defined properly,

The current user strenth in the system are 10k,issue is that there are different business unit of this company which has different processes/methodology to work,so we cannot remove any current access of users as it would impact business directly.

Instead we have to redesign the current roles into more SOD free roles or create separet roles in the system which would be SOD free.

Their usage of GRC is also very minimal so lot of manual work needs to be done.

Thanks

Uttam

Re: Need Help from Gurus on Role Redesign

Former Member — Wed, 26 Dec 2012 10:44:06 GMT

Hi Uttam,

There is no bible that tells you the easiest way to design roles. As pointed by John, it may depends on the # of users too. If the user base is only (or below) 100, there is no point in segregating them at a very micro level, since you will end up assigning them to the same users which gets extra level violations (risks) again. Your SAP system, business teams, and company processes might be the best bet to decide on the future design.

Regards,

Raghu

Re: Need Help from Gurus on Role Redesign

Former Member — Sat, 29 Dec 2012 19:26:24 GMT

"Their usage of GRC is also very minimal so lot of manual work needs to be done."

If the business has invested in any of the RAR tools then they are probably extemely eager to get the management SoDs and Criticals down.

EDIT - I initially took this to be reference to the VIRSA/GRC/AC10 tools but maybe this really means the business doesn't bother about SoDs and criticals at this time

EDIT

It's not easy/business friendly to try doing a remediation by stealth...

Is this work covered by an approved project?

Cheers

David

Message was edited by: David Berry

Re: Need Help from Gurus on Role Redesign

Former Member — Tue, 15 Jan 2013 14:47:59 GMT

Hello David,

Yes this is covered by a approved project, SAP Security team does not want to get involved in this task so Business has hired me to look into this SOD issues and redesign the current sap roles.

Thanks

Uttam