Creating conflcit matrix with RSUSR008_009_NEW

[Former Member]

Dear Experts,

I am keen to know if someone has made use of the report RSUSR008_009_NEW ?

I am not sold to the idea of using other tools for checking user level SOD issues and would like to invest time to understand the report and availaible options in it

This is what i want to do:

spend time with the auditors to create a set of conflcit groups. Identify the underlying objects of each conflcit group and maintain them in the grouping of critical combinations

This matrix can then be the base on which Role authorizations can be assigned/rejected. It would also give the option of identifying users who have critical ombinations in their authorizations (which could have been prior approved, and the paperwork workflow can be checked for this assignment), which makes the complete process ACCEPTED by the auditors

Could you share your ideas/opinions on this?

• I would appreciate answers/opinons relevant to this topic (No GRC, VIRSA....... answers, please)

• I have read one or two posts on this topic and i didnt see any conclusive answers on this

[Former Member]

Hi Shekar,

I have used it before a few times, but first of all I do have one question:

Are you a consultant or an internal resource?

If you are a consultant then you will, in my experience, cost your client more implement this properly than you would be to buy a product. There are some good products out there that are relatively inexpensive to buy and implement.

If you want to go ahead with it then that's cool and you are approaching it the right way.

From a technical perspective there are a good number of OSS notes that you need to apply, searching on the report name should bring them up.

The approach with audit is correct. Identify your main business functions and then identify which ones conflict. There are a few matrices on the internet (the most common one is a copy of one hidden in ASAP) which you can use as a base and add in stuff relevant to your business or client. You can then assign transactions and/or objects to those functions which are represented by Groups and maintain the conflicts via the ID's.

As long as you can get to grips with the (poor) usability of the tool, this will give you everything that you need.

A few years back I was going to create an uploader to populate the relevant tables, in retrospect it's a shame we didn't do it.

Good luck

[Former Member]

Hi Alex

I read a lot of positives from your mail and it is quite encouraging

> Are you a consultant or an internal resource?

Hmmm......I am a consulant (hope it is not a bad qualification to have )

> If you are a consultant then you will, in my experience, cost your client more implement this properly than you would be to buy a product. There are some good products out there that are relatively inexpensive to buy and implement.

> If you want to go ahead with it then that's cool and you are approaching it the right way.

I dont understand, are you suggesting that there would huge maintenance activities involved?

I have a base matrix proposed, accepted and approved by the internal compliance team, the internal audit team and the external auditors (one of the big four, unethical to mention the name )

I have a list of conflcit groups and not allowed combinations and the transactions in each coflcit group and the Authorization objects with activites that are checked .

I have 3000+ roles in the system and one of the proposals (infact it is 60%through with the development) is to have a new transaction created for user maintenance (ZSU01 replacing SU01) and in this , in the roles tab, the idea is to change the way it looks and split the screen into 3 parts, one part shows the roles that are already assigned to the user, the other part is more of a search engine that allows you to search for all possible roles (Domain wise or country wise, as maybe the case) and assign the needed roles. when the search engine identifies a role with a particular transaction, it is then validated by checking Z-Table entries on whether the role can be combined with what the user already has, and disallow if it is not a accepted combinatiom. Workflow approvals should follow for such cases.

Well the problem here is, I am dead against this idea: Having a table with 3000 roles and their probable combinations sounds like a nightmare, every inclusion of a transaction to a role - could change the table entires. in short it becomes a "Live" system on its own.

Whereas, if we confgure the critical combinations based on the agreed rule set , this wouldnt change for a long time and making use of the availabel reports would be better (It would mean a big bg effort for configuring the critical cobinations, and also look at few modifications to the report) - this is my idea, what do you think - does it sound ok?

[koehntopp]

The report will give you similar analysis results as the tools do.

However, there is a reason why the tools do have a valid market (actually more than one...):

- Creating the conflicting TCodes/fields is hard. The default ERP rule set for SAP BO AccessControl, for example, hase some 45000 rules it will check. We can differ in opinion if these are all required, but you get my point.

- When creating is hard, maintaining is even harder. You need to cope with changes in processes and changes in customizing/development. This is one reason why you don't maintain the individual rules in Access Control, but go via risk - functions - tcodes/objects to get to them automatically.

- The result of the analysis is only as useful as its incorporation into ALL authorization relevant processes (development, customizing, role management, uder management, reporting etc.). Any process you miss creates tons of additional work in running after the issues.

- You might also want to assign a severity and one or more owners to conflicts in order to deduct the correct remediation, control or responsibility.

- You might need to manage exceptions, as a conflict you identify in one part of the company might be a required process in another. This needs to be managed/reported/documented.

- The report is detective, not preventive. I.e. you will only detect issues after a user has them already, then run after him to take authorizations away. How do you check for alternatives?

All in all: if all you need to do is find out about a few unwanted combinations, you should be fine. For serious SoD and/or critical authorization management, you might find that using one of the available tools makes life A LOT easier.

Frank.

[Former Member]

Hi Frank,

I knew you would respond i have read your related posts . No offence meant but somehow i feel that GRC is wrapped in cotton wool in your reply to Alex

Anyway, my personal opinion is that tools are made availbale because no end user in any company wanted to understand how the technical set-up,the audit compliace, the compensation controls, risk mitigation and remediation all work together..........and i personally feel it is NOT as complex as it SOUNDS. It is difficult - no doubt on that, but i think if you get the hang of it, it could be a worthwhile effort

And for the preventive part you mention, i would like to customize the report so that i can check the user level SOD before anything is added, i guess it makes sense that way.

[koehntopp]

Whereas, if we confgure the critical combinations based on the agreed  rule set , this wouldnt change for a long time and making use of the availabel reports would be better (It would mean a big bg effort for configuring the critical cobinations, and also look at few modifications to the report) - this is my idea, what do you think - does it sound ok?

Of course you can do that, but I guess the requirements will continue from there. You have a very limited set of users covered right now, and a small set of use cases.

Builiding that system,maintaining it and keeping up with requirements will be a huge development effort, not even considering support and maintenance.

Of course you can do that and most likely it will work for your current scenario, the consideration is whether it's worth the effort of doing it vs. buying some standard package on the market.

Frank.

[Former Member]

>

> Of course you can do that and most likely it will work for your current scenario, the consideration is whether it's worth the effort of doing it vs. buying some standard package on the market.

Hi Shekar - with ref to your consultant/non consultant question, this comment from sums it up for me to be honest.

The time to get RSUSR008_009_NEW up and running is not inconsiderable. I have spent weeks on some projects configuring it and just as long training people how to use it properly. I doubt I would even take on an engagement where this was required considering that there are better products out there for a range of different budgets.

From your description of the ZSU01 and big table, I agree with you that it's not a good idea as there is no content check.

[Former Member]

Frank,

In all fairness, the client i work for would love to know that there is a possibility.For the client, every penny saved is a penny earned and they would love to entrust such a job to a consultant (so that it gives easy target practice) - it is a matter of money over a young dispensable consultants' grey cells

I dont really know if i end up doing all the effort, but atleast i know that it could be attempted.

thanks for your inputs

• I would like to keep the thread open for some time to see some more opinions on the topic and ANY kind of Encouragement on the task being attempted ( I feel like i just started from CAMPVII on a long climb )

[Former Member]

>

> From your description of the ZSU01 and big table, I agree with you that it's not a good idea as there is no content check.

I am glad that there is someone who agrees with me on this topic, i think i will print this post to show it to the "wizard" who penned the development request for ZSU01

>

> there are better products out there for a range of different budgets.

I will try to look up for a few, but do let me know if there is something you personally felt was good

[Former Member]

Would appreciate a few more ideas/suggestions on this topic.

Just wanted to keep in the first page for a day more no reposnes today and i will close it tommorrow

[Former Member]

My contribution:

> Just wanted to keep in the first page for a day more

Please don't do that. Imagine if everybody did...

Interested folks will find your thread anyway and may only read the forum once a week.

Cheers,

Julius

[Former Member]

I thought you would have more to add to the topic

Considering that you had a discussion in an other post on this topic earlier with Frank and you were suggesting that it would be a good idea to work on the report

[Former Member]

> > Just wanted to keep in the first page for a day more

> Please don't do that. Imagine if everybody did...

>

sorry, for that - it was a real cheap trick

[Former Member]

> it was a real cheap trick

That is exactly what RSUSR008_009_NEW is as well.

It is simple and it works, but is not state-of-the-art technology.

If you keep it simple and go for the important critical authorizations and show-stopper type of SoD conflicts (forget about S_TCODEs..) then you will cover a lot of your risks with 40% of the effort.

The main buggers are that it is "local" to each client, and when you apply support packs you don't get updates for your functions and actions like you do with GRC.

On the otherhand, no brainstorming session in a land far away will introduce some theoretical fluffy-stuff into your system either, like some other tools do when you adopt their rulesets and click on "Go".

All-in-all, the industry norm seems to have settled into buying the best ruleset as a prepackage and mitigate from there to make the redlights go away. Given the options and the proximity to the original development, I would go for SAP GRC, particularly if you have the licenses already.

Another aspect to this is that no one has mentioned what to do with customer coding yet and a prepackaged ruleset cannot possibly deliver that for you. You can only do this yourself. Since [SAP Note 978447|https://service.sap.com/sap/support/notes/978447] you can now simply place a * into RSUSR008_009_NEW and click "Go"...

Cheers,

Julius

[Former Member]

well...............i can only partially agree to what you say. If considerable time and some concrete effort is spent, i am sure one can make a wonderful rule-set and i am also not completely convinced tha the report is a throw-away

GRC is the last and least preferred in the environment i work in and they have their valid reasons for it, so forget about it

I dont know yet if i will still configure the report (quite a few approvals are pending) and build my own Z that would call the report and display things as i conceive, but if i do it, I hope i have your assurance that it will be a front pager on the forum

[Former Member]

> If considerable time and some concrete effort is spent, i am sure one can make a wonderful rule-set and i am also not completely convinced tha the report is a throw-away

Yes, this is definately true and I don't see why only partial agreement is needed.

I have used it before and am currently using it for one landscape as well because the customer does not have a GRC license included in their agreement.

We developed our own emergency user solution and I threw in my collection of RSUSR008_009_NEW rules which I have built up over the years, with a few tweaks. It took one day and was finished.

But if you know what you are doing and have already paid the licenses, then you can get GRC-RAR, CUP, SPM and self-service installed and up&running within a week as well.

Of course the real work starts once you get the results of whichever "Go" button you click on. So.... "it depends" is the averall answer, excluding custom coding

Cheers,

Julius

[Former Member]

sometimes I hate giving away on a good thought, i look at this is based on a few things:

1. The client has NO idea of procuring GRC

2. they tried building their own Z-Program, which for me looks and feels filthy (read the above exchanges, you would understnad why i say this)

3. The client & I are happy with the rule-set we have

4. I think it is a matter of a task being very time taking and difficult one - but not a "impossible one ", or is it?

the reason i wanted to hear from you is, i read in the other post that you worked on this report and i wanted to know if it is a impossible effort or if it is not worth trying (like modifying SSM2 suggestios i had )

I can plan, check, design, write the development request - but cannot code........I cannot debug to death and understand how difficult or complex the code is and that was the precise reason i wanted the experts views

[Former Member]

Then go for RSUSR008_009_NEW and keep an eye on OSS notes for it.

If you have questions, then feel free to ask.

Cheers,

Julius

[Former Member]

I am pleased, i am closing the thread. will definitely post again if i find my way with it

cheers, and thanks to all

[Former Member]

Thanks a lot to everyone who contributed on this topic.

I configured RSUSR008_009_NEW and am pleased with what it shows. I havent tried it in the Production environment in real time, but in the development system it works the way i wanted it to work (but with a slow response time

you guys were great and your advices have been invaluable

[Former Member]

Hi Chandrashekhar

Congrats on finishing your task on RSUSR008_009_NEW.

How much time did it take? I am contemplating to use this.

Looking forward to your valuable suggestions / approach / procedure followed.

Thanks

Yogesh

[Former Member]

Hi Alex

I searched ASAP and SAP Service Market Site but couldn''t find the Standard SoD Matrix. Can you please help me by revealing its location?

Thanks

Yogesh

[koehntopp]

Yogesh,

there really is no such thing as a "standard" matrix, other than what gets delivered with the GRC product, and is its intellectual property.

Frank.

[Frank_Buchholz]

Did anybody ever have tried to implement the basis checks of the Security Optimization Servive (SOS) as critical authorizations within RSUSR008_009_NEW ? (I know it's not about SoD in applications but it's critical anyway...)

Here's the description of the checks of the SOS: https://service.sap.com/sos -> Media Library -> Media Library -> Security Optimization Service - ABAP Checks

Cheers,
Frank

[Frank_Buchholz]

Please have a look to the new Blog

Export/Import Critical Authorizations for RSUSR008_009_NEW

Limitation: this new report covers "Critical Authorizations" and "Variants of Critical Authorizations" but not "Critical Combinations".

Kind regards

Frank