Violations that do not have to remediated/mitigated

[Former Member]

Dear All,

I have a small question regarding Access Control (RAR and CUP).

We have customised our ruleset and developing new rules all the time. Many business areas ask us to include transactions where they would like to monitor who has access to it, however, it is not a "super-"critical transaction so that a violation leads to a mitigation or remediation.

The mitigating control for those reported violations would just be something like "is part of my team"... however, as far as I know, just to say "is part of my team" is not the end of story.

First of all, the mitigating controls have to be documented, then they have a limited validity so they have to be renewed as well. Also, the number of violations (or mitigated violations) is misleading, since it is not really a violation. So each violation causes quite some effort to manage it...

Therefore the question: Since it is possible to classify the risks for the rules as "low", is it also possible to configure the system in way, that for these risks no remediation or mitigation is necessary? So that in RAR they are not picked up by reports and in CUP provisioning is possible for those "low" violiations.

The perfect solution would be something like that those violations are generally ignored from the system, however if desired, you can check manually who is violating in order to see who has access to the transactions.

Hopefully I made the scenario clear.. but I guess that other companies as well have a similar scenario....

Thanks

Muhammad

[koehntopp]

You could also classify those risks as low, and only run background reports for risk levels medium and higher.

Frank.

[Former Member]

Frank,

Where exactly you can select more than one risk level while running background job (batch risk analysis)? I don't think that is an option.

Regards,

Alpesh

[koehntopp]

Maybe I'm wrong here - doesn't setting the default risk level to "Medium" basically mean "Medium or higher" ?

Frank.

[Former Member]

I am affraid to tell you that your are wrong Franck. Selecting medium gives you medium risks only and not medium + high + critical ones.

[koehntopp]

OK, my bad - I have a customer who set this to Critical Only to do what's being discussed here.

[Former Member]

Hi Everyone,

Thanks for the answers. Just want to confirm.

Even if run the batch risk analysis for "critical only" or for "high"only, CUP will still alert me in the create/change process although a user is just violating a "low" risk.

Thanks

Muhammad

[Former Member]

Yes. It would. That is why you need to put the low risks into a separate non-default ruleset as I explained earlier.

Regards,

Alpesh

[Former Member]

Thx

[sunny_pahuja2]

Hi,

I have not come across this scenario, but I think you can use Firefighter concept and by assigning these transactions access to FF ID, you can easily track it who is using these t-codes and what all actions have been performed with these t-codes instead of doing mitigation in RAR and all.

Thanks

Sunny

[Former Member]

Hi,

If these tcodes are not part of the daily job and not being used much then you should get away with Firefighter.

If these tcodes are almost used daily then the only way out would be to create a separate ruleset for them. I have done it at my previous client. We had 2 rulesets where the main ruleset was our default ruleset. We added all the other tcodes to secondary ruleset so the violations would not be reported in RAR or CUP. We can still run an adhoc risk analysis against the secondary ruleset when we need to find out who has access to those tcodes.

I hope it makes sense.

Regards,

Alpesh