GRC Journal - (Page 40) SEGREGATION Of DuTIES AND COMPLIANT uSER PROVISIONING SAP GRC Access Control applications use application-independent abstractions of risks and their underlying business functions to define the rules that identify the essential SoD violations. In its simplest form, a risk consists of two or more business functions that are in conflict. Each business function maps to one or more application-specific actions. Each action may in turn be dependent on one or more action-specific permission. These mappings allow SAP GRC Access Control to detect any access violations across various applications. Thus, the rules architecture of SAP GRC Access Control can be viewed as a pyramid that starts at the top with a defined set of specific business risks, supported by a set of all business functions that when performed by the same person constitute a SoD violation. Abstract business functions are then mapped to concrete technical objects in each target enterprise application. Finally, for execution, SAP GRC Access Control generates a much larger set of rules automatically as permutations of all actions and permissions of one business function against all actions and permissions of any other business function defined in the same risk. Benefits of the Rules Architecture A primary benefit of the rules architecture is that risks and business functions are defined in commonly understood terms. This empowers regular business users to use SAP GRC Access Control applications. They only deal with the much “narrower” top part of the pyramid – the risk definition. There is one central and system-independent definition of the policies across the enterprise. Therefore, risks and business functions need only be defined once SAP GRC Access Control applications then map those risks and functions across multiple target applications. This avoids fragmentation and duplication of efforts. This is where IT specialists’ know-how about target application systems and their security capabilities comes in. A central rule set ensures consistency of policy and checks for violations that may be spread over multiple applications. This is how SAP delivers true cross application access control environment. Largest Library of Pre-Defined Rules SAP GRC Access Control comes with an unrivaled set of rules for major enterprise application software. The powerful and comprehensive rules library can easily generate well over 100,000 rules out-of-the box for use with SAP applications. It can generate a similar number of rules for major enterprise application software from other vendors. In addition, the rules set can be expanded to include extensive support for legacy and custom application. SAP GRC ACCESS CONTROL SOFTWARE ARCHITECTURE The design of the architecture for SAP GRC Access Control delivers a level of performance, integration, extensibility, and scalability unmatched in the market. Running on SAP NetWeaver, the proven business platform, SAP GRC Access Control takes full advantage of advanced SAP technology to simply all other GRC applications. Through real-time agents (RTAs), web services, and open interfaces, SAP GRC Access Control can be extended to virtually any application, SAP and non-SAP alike. In addition, the application can easily be integrated with other IAM (Identity and Access Management) solutions to provide the same high level of compliance and risk mitigation to users generated via those applications. Architecture Overview An SAP GRC Access Control application consists of the core Java module (Virsa Compliance Calibrator, Virsa Role Expert, Virsa Access Enforcer, or Virsa FireFighter for SAP), deployed centrally, as well as one or more RTAs – deployed locally on the target application software systems – that allow it to communicate to the target application. Where real-time isn’t feasible or desired, an offline file extraction (EXT) can be used instead of the RTAs. One centralized, across-enterprise rule set within the GRC repository allows the application to analyze access and authorization risks across the enterprise for a wide range of enterprise application software systems and a wide range of essential business processes. 74 BTQ Q1 2007 | www.btquarterly.com Business Trends Quarterly http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.