Option Pack › Segregation Of Duties (SOD) › Overview

Overview

Segregation Of Duties (SOD) ensures that no user has access over two or more phases of a transaction, so that a deliberate fraud is less likely to occur.

Currently SOD works in a Detect mode. More advanced SOD works in a Detect & Remediate mode, however advanced SOD has the following limitations:

• It only identifies in-process SOD violations. Someone may have already misused the system and caused damage.
• Remediation requires costly manual configuration.

The Option Pack SOD feature prevents the violation from occurring at all, rather than allowing the violation to happen and then remediating it.

SOD provides the following features:

• Identifies and prevents a violation between two newly requested accounts
• Identifies and prevents a violation between a newly requested account and any existing accounts the user already has
• Holds a SOD rules or connects to an existing SOD rules table (if available)
• Analyzes across applications and systems
• Integrates SOD analysis and prevention with the approval and provisioning processes
• Provides a real-time view of current SODs
• Reports SOD audit information periodically
• Provides attribute-level SOD analysis, such as SAP role level, Active Directory group level, and so on

  Important! SOD should be audited to regulate when it was approved, by whom, and for what purpose. The SOD process always occurs before workflow approval.