System and method for real time detection and prevention of segregation of duties violations in business-critical applications

1. A system configured for real-time detection and prevention of segregation of duties (SoD) violations in a software application, comprising:

a software application monitor configured to monitor an action executed by a user of the software application in real-time; and

an SoD conflict detection engine comprising a processor configured to execute instructions stored in a memory, which when executed, perform the steps of:

receiving by the SoD conflict detection engine a first action notification from the software application monitor comprising a first action and an associated user; storing the first action notification;

receiving by the SoD conflict detection engine a second action notification from the software application monitor comprising a second action and the associated user; and

determining whether the second action is a conflicting action with the first action according to a conflict rule in a conflict rule database,

wherein the SoD is configured to monitor a software application to determine whether the second action of the associated user creates a conflict with the first action that would otherwise he authorized for the associated user,

wherein the packet inspector is further configured to perform the steps of:

receiving an application protocol packet from a communication network in communication with the software application or receiving application logs from the software application;

forming the first or second action notification comprising the first or second action; and

forwarding the first or second action notification to the SoD conflict detection engine.

2. The system of claim 1 , wherein the packet inspector further comprises a packet collector configured to determine a protocol family of the packet according to the destination port and/or a packet structure of the packet.

3. The system of claim 1 , wherein the packet collector further performs the step of extracting a username from the packet and updating a connection directory with that information.

4. The system of claim 3 , wherein the packet collector further performs the steps of:

determining whether the packet is compressed; and

decompressing the packet.

5. The system of claim 4 , wherein the packet collector is further configured to access a context database to determine the protocol family of the packet according destination port for the packet.

6. The system of claim 4 , wherein the packet collector is further configured to dispatch the packet to a protocol processor associated with the determined protocol family.

7. The system of claim 4 , wherein the packet collector is further configured to update the connection directory with the source and destination IP address and port of the packet.

8. The system of claim 1 , wherein the SOD detection engine farther performs the steps of:

querying a business table and/or a system table in the software application;

checking if two conflicting actions are in a common process flow; and

if the two conflicting actions are in a common process flow, outputting a critical detective alert.

9. The system of claim 1 , wherein the Sol) detection engine is further configured to perform the step of updating an historical actions database.

10. The system of claim 9 , wherein the processor further performs the step of determining the first or second action of the user in relation to a period of time.

11. The system of claim 10 , wherein the processor further performs the step of determining if the user existed during the period of time.

12. The system of claim 11 , wherein the processor further performs the step of determining if the user was unlocked during the period of time.

13. The system of claim 12 , wherein the processor further performs the step of determining if the user executed the conflicting action during the period of time.

14. The system of claim 13 , wherein the processor further performs the step of outputting an alert.

15. The system of claim 14 , wherein the alert comprises one of the group consisting of a detective alert and a preventive alert.

16. The system of claim 1 wherein the SoD detection engine is configured to perform the step of looking up the user and first or second action in a table and determining if the user has permission to execute the first or second action upon receiving an action notification from the software application monitor.

17. The system of claim 1 , wherein the packet inspector is configured to perform the step of creating or updating a connection entry in a connection directory using information selected from the group consisting of an IP source, a destination, and port.

18. The system of claim 1 , wherein the packet inspector is configured to perform the step of extracting from the packet the first or second action from a group consisting of a transaction, a report, a program execution event, and a permission assignment.

19. The system of claim 15 , wherein the preventive alert indicates a segregation of duties violation.

20. The system of claim 15 , wherein the detective alert indicates the execution of the actions composing a segregation of duties violation.

21. The system of claim 19 , further comprising a display screen configured to present a visual representation of the alert.

22. The system of claim 20 , wherein the alert is forwarded to another application connected to the system via a software applications interface.

23. The system of claim 1 , wherein the software application comprises a business-critical application from SAP and/or Oracle.

24. The system of claim 23 , wherein the processor is further configured to perform the steps of:

reading a SoD matrix from a third party; and

populating the conflict rule database according to the contents of the SoD matrix,

wherein the SoD matrix further comprises a plurality of entries, each of which expresses an incompatible permission and/or role inside the business-critical application.

25. The system of claim 6 , wherein the protocol processor comprises a processor configured to process a protocol selected from the group consisting of SAP Dispatcher, SAPDIAG, SAP RFC/CPIC protocols, SAP ICM protocol, HTTP, IIOP, SAP P4, SAP HANA SQL/MDX protocol, JDENet protocol, JD Edwards Agent protocols, JMX, and SOAP.

26. The system of claim 1 , wherein the first and/or second action comprises executing within the monitored software application at least one of the group consisting a program, a transaction, a report, a function, and an assignment of a permission.

27. A system configured for real-time detection and prevention of segregation of duties (SoD) violations in a software application, comprising:

a software application monitor configured to monitor an action executed by a user of the software application in real-time; and

an SoD conflict detection engine comprising a processor configured to execute non-transitory instructions stored in a memory, which when executed, perform the steps of:

receiving by the SoD conflict detection engine a first action notification from the software application monitor comprising the a first action and the an associated user; storing the first action notification;

receiving by the SoD conflict detection engine a second action notification from the software application monitor comprising a second action and the associated user; and

determining whether the second action is a conflicting action with the first action according to a conflict rule in a conflict rule database,

wherein the packet inspector is further configured to perform the steps of:

receiving an application protocol packet from a communication network in communication with the software application or receiving application logs from the software application;

forming the first or second action notification comprising the first or second action; and

forwarding the first or second action notification to the SoD conflict detection engine.