Mitigating control - download and upload feature

[Former Member]

Hello !

I am trying to abuse the mitigating control feature in order to reduce the hits, as access control lacks the feature that it is ok and confirmed that a user has certain critical transactions in his role.

Anyway, as the definition on the web frontend is quite time-consuming, I tried it with the download and upload feature. It also works fine, unless it comes to table VIRSA_CC_MITROLE which includes DATE values.

At that point the file looks like the following:

M VIRSA_CC_MITROLE MITREFNO RISKID ROLEID VALIDFROM VALIDTO MONITORID STATUS

D VIRSA_CC_MITROLE FI_01 F100 ABCDE 15.03.2011 14.03.2012 XYZ 0

This results in the following error:

SQL:=>Insert into VIRSA_CC_MITROLE(MITREFNO,RISKID,ROLEID,VALIDFROM,VALIDTO,MONITORID,STATUS ) Values(?,?,?,?,?,?,?)

Aufzeichnen::Line Number :37 : D VIRSA_CC_MITROLE FI_01 F100 ABCDE 15.03.2011

The last line stops at the FIRST date value.

I also tried to execute the following statement in the CCDebugger, but it didn't work:

Insert into VIRSA_CC_MITROLE(MITREFNO,RISKID,ROLEID,VALIDFROM,VALIDTO,MONITORID,STATUS ) Values('FI_01','F100','ABCDE','20110315','20120314','XYZ',0);

I also tried without ' regarding the date values and with 20110315 and 2011-03-15 but it didn't help:

contains the semantics error[s]: - type check error: new value (element number 4 (CHAR)) is not assignable to column >>VALIDFROM<< (DATE) - type check error: new value (element number 5 (CHAR)) is not assignable to column >>VALIDTO<< (DATE)

Does any have a solution for this issue ?

Kind regards,

Max

[koehntopp · Accepted solution]

Hi Maximilian,

the problem is quite obvious - the error message (in this case) tells you exactly where it is: the date format is wrong.

In the files that I have been using successfully the date is in US format, i.e. 2011-03-15, no delimiters. Try that with the text file again.

You can also do an export first for a manually created mitigation to see the correct format.

Frank.

[Former Member]

Hi Frank,

yes you were right. I found it out by myself and I forgot to close the question. However, Excel is crap and it seems virsa didn't know what localization function in Java is ... I don't care about US date format, I am in Europe

Kind regards,

Max

[Former Member]

Hi Max

CCDebugger is a read-only tool, hence insert commands will not work.

If you would want to get rid of your problem at the root, move your critical transactions from your default rule set into a separate one. You can deal with mitigation of critical transactions separately in RAR.

Regards,

Vit

[Former Member]

Hi Vit,

thanks for you reply ! Either I didn't get your point or it is not a solution for my problem. Let's say there is a SAP CC role which is assigned to every developer and customizing expert. If the SAP CC consits of 20 people you get tons of false positive in RAR. Moving the risks into a seperate ruleset doesn't help, as I still need to identify users which are actual risks.

My thought was to define a compensating control for the SAP CC role and exclude it from the hit list. IF this would work, it would be very cool !

Kind regards,

Max

[Former Member]

Actually I am doing the same thing SAP suggests in note 1527113.

[Former Member]

Hi Max,

I guess I didn't understood your question. Sorry about that.

You can indeed mitigate at role level. But when the risk will pop up on user level. One solution would be to exclude all CC members when you define a batch risk analysis with the "exclude object" button at the bottom.

Or you can create separate CC roles which you can exclude the same way.

Because customization and development are not done on production systems our general recommendation is that the CC members should only have read-only authorizations in the production systems. Only on request from business (valid helpdesk ticket) they can preform live actions in PRD (with a firefigther account).

regards,

Vit

[Former Member]

Vit,

acutally you are totally right, but reality is different - no need to say I am an IT Auditor )

Thanks for your answer.

However, this doesn't solve my upload problem.

Kind regards,

max