AE 5.2 - Risk Analysis problem

[Former Member]

Hello,

I am facing an issue with AE 5.2. When I create a request to assign roles and perform Risk Analysis, I get some SOD violations messages.

I copy the some assigned roles and paste them in CC 5.2 -> Informer -> Risk Analysis -> Role Level and I have no conflict!

Can you please advise why I have conflict with AE and not with CC?

Thank you very much indeed,

Cheers,

Abderrahim

[Former Member]

Hi,

Are you checking the SOD violations at both Critical Action, and Permission Level. Check both and see if the risks pop-up.

Else, it might be a false positive.

Regards,

Raghu

Edited by: Raghu Boddu on Nov 8, 2010 9:02 PM

[Former Member]

Hi Raghu,

When I check the SOD violations at Permission Level, there is no conflict in CC. However there are some in AE.

When I check the SOD violations at Action Level, there are some conflicts in CC and a few in AE.

Thanks,

Cheers,

Abderrahim

[Former Member]

Hi,

Which version of GRC are you on? Let me know the patch level too.

Rgds,

Raghu

[Former Member]

Hi Raghu,

The versions are:

Access Enforcer: AE 5.2 SP11 Patch1 (Build-62316)

Compliance Calibrator: CC 5.2_10 Build ID: 03270808

Thank you,

Cheers,

Abderrahim

[Former Member]

Hi,

Any update, please?

Thanks,

Regards,

Abderrahim

[Former Member]

Hi,

It is just a False Positive. Consider upgrading to the next available SP.

Regards,

Raghu

[Former Member]

Hi Raghu,

Thank your for your response.

As we have the following versions below:

AE 5.2 SP11 Patch1 (Build-62316)

CC 5.2_10 Build ID: 03270808

Which SP do you suggest to apply?

Thank you,

Abderrahim

[Former Member]

Hi,

Please check at the marketplace to identify the appropriate update. You can find the list of fixes in every update, which you can refer before you implement.

Regards,

Raghu

[Former Member]

Check to ensure that the risk analysis options, sometimes in the 'more' menu, are set the same for ignore mitigating controls or not.

Sounds like you have CC set to ignore mit. ctrl's.

[Former Member]

Hi Ken,

In CC, the option 'Ignore Critical Roles & Profiles" is set to "Yes"

In AE, the option "Consider Mitigation Controls" is checked

Thank you,

Regards,

Abderrahim

[Former Member]

Hello,

In fact, It was only a false positive issue because:

In CC I perform a risk analysis with Permission Level option.

However, I get risk violation in AE with Critical Transaction for the same role.

The right way is to run risk analysis in CC with Critical Actions.

Thank you for your collaboration.

Regards,

Abderrahim

[Former Member]

Hi,

Sometime the problem I have is that there is an option of case sensitivity in RAR and I have to play around with it. Turn it off/on or manage it accordingly.

Thanks,

Chinmaya

[Former Member]

Hi Chinmaya,

Many thanks for your response.

Where can I find enable/disable this option?

Thanks,

Cheers,

Abderrahim

[Former Member]

Hi,

I currently do not have access to a GRC, so cant be sure, but I would say its in Additional Options. I have not used 5.2, but I think in 5.3 its under additional options.

Thanks,

Chinmaya