Could you please share any documentaion on best practices for Segregation of duties (SOD) in cloud and the features IFS have in this area
Solved
Segregation of Duties (SoD) - in IFS Cloud
Best answer by Kasun Balasooriya
Please Refer the following link:
Segregation of Duties Analysis - Technical Documentation For IFS Cloud
As noted in the documentation,
The Segregation of Duties analysis is a tool to analyze how well the security is setup separating the duties between users. The analysis shows any inappropriate user access and identifies which users that have access to specific functions in the system.
You may use this tool as noted in the documentation to identify and resolve the SOD conflicts.
For details on setting up Functional areas for SOD including Setting up Functional Area Conflicts, please refer the following documentation link:
Functional Areas - Technical Documentation For IFS Cloud
Thanks,
Kasun
+20Please Refer the following link:
Segregation of Duties Analysis - Technical Documentation For IFS Cloud
As noted in the documentation,
The Segregation of Duties analysis is a tool to analyze how well the security is setup separating the duties between users. The analysis shows any inappropriate user access and identifies which users that have access to specific functions in the system.
You may use this tool as noted in the documentation to identify and resolve the SOD conflicts.
For details on setting up Functional areas for SOD including Setting up Functional Area Conflicts, please refer the following documentation link:
Functional Areas - Technical Documentation For IFS Cloud
Thanks,
Kasun
+6
Have you already set this up? I was experimenting with it, but the setup seems at Projection level where I can’t determine that I only consider it a conflict if there are Writing Rights/FULL/CUSTOM? If ReadOnly I would not consider it a conflict.
We are on 24.2 and would consider the SOD within IFS to be worthless. I cannot separate out read only access from create/modify. We allow a great deal of view only access so I cannot use view access as a conflict.
SOD Works pretty well for specifically Projection and Entity Actions but indeed is not super useful for Entity CUD Actions meaning being able to segregate read/write from an entity.
Basically like these:
You can easily create conflicts based on whether a user has got access to entity action “Activate” or “Apply Bid” for instance, but it doesn’t look like you can make it check for simple CUD entity action grant.
So indeed SOD doesn’t seem super practical if you want to highlight cases where Write access would be considered an SOD breach, but Read only would not be.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.