CC 5.2. Does this rule work ?

[Former Member]

Gd morning guys, i've currently created a rule but due to insufficient authorization i was not able to test it out in the relevant roles but i would like to hear your advise on this sample/simple setup.

I want to create a rule such that a User should not be allowed to create a UserID and delete them. Therefore I created a Risk with 2 functions;

1. Create User. Objects include S_TCODE which is of course tcode 'Su01'. In addition, under S_USER_AUT, i granted 01 access which is to create User.

2. Delete User. Objects include S_TCODE which is of course tcode 'Su01'. In addition, under S_USER_AUT, i granted 06 access which is to delete User.

For this risk created, will 2 roles having the same t_code but different authoriation values, be flagged out as a risk?

Message was edited by:

Koh Boon Leng Peter

[Former Member]

Gd morning guys, i've currently created a rule but due to insufficient authorization i was not able to test it out in the relevant roles but i would like to hear your advise on this sample/simple setup.

I want to create a rule such that a User should not be allowed to create a UserID and delete them. Therefore I created a Risk with 2 functions;

1. Create User. Objects include S_TCODE which is of course tcode 'Su01'. In addition, under S_USER_AUT, i granted 01 access which is to create User.

2. Delete User. Objects include S_TCODE which is of course tcode 'Su01'. In addition, under S_USER_AUT, i granted 06 access which is to delete User.

For this risk created, will 2 roles having the same t_code but different authoriation values, be flagged out as a risk?

Message was edited by:

Koh Boon Leng Peter

[Former Member]

Hi Peter,

The fundamental SOD principle is:The user who "create" should not have authorizations to "delete".Here the T-code for both the creation and the deletion is the same.This violates SOD;as much as this,this amounts to risk and will be flagged as such [Risk].

From the SOD point of view it is the risk of access that counts and is not with standing the authorizations values.

hope this helps.

Regards,

Ramesh.

[Former Member]

Hi, thanks for the answer... it is at least correct at the transaction level

if the User has 2 of the same tcode access, the system will flag out as an SOD (at action level).

Message was edited by:

Peter

[Former Member]

Wouldn't be easier to create a critical permission that contained both of these authorizations? Then you could create a risk that contained this critical permission. It wouldn't flag as an SOD but it would show up or your critical permissions report

[Former Member]

Good point.

Normally in such cases,we use to insist for compensatory controls.

The "critical permissions' are given only based on satisfactory " compensatory controls".Once the risk is compensated,this is no more 'SOD" violation.This is why you will not get the "SOD" Flag.

[Former Member]

yes it can become risk at permission level also. Depend how u define risk