System and method for scalable multi-application user access and segregation of duties review
Security can be improved in a business application or system, such as a mission-critical application, by automatically analyzing user access (UA) and segregation of duties (SoD). This analysis may be using a graphical representation of a model with nodes for business application concepts and edges for relationships between nodes. A review of the graphical representation is used for UA and SoD.
1 . A computer-implemented method for reviewing user access rights comprising:
generating, with a processor, a model, the model including nodes for business application concepts and edges for relationships between the nodes;
providing, with the processor, a graphical representation of the model including the nodes and the edges; and
reviewing, with the processor, the user access rights based on the graphical representation;
wherein:
the user access rights comprise a segregation of duties;
the reviewing further comprises reviewing, with the processor, the segregation of duties based on the graphical representation, where reviewing the segregation of duties comprises a separate review for each of multiple groups of permissions to further identify conflicts; and
reviewing the segregation of duties comprises:
determining, with the processor, which users have access; and
determining, with the processor, how access is assigned.
2 . The computer-implemented method of claim 1 , wherein:
the graphical representation comprises a graph model;
the graph model comprises a directed graph showing the nodes and the edges;
the nodes in the graph model represent a feature including at least one of a user, role, profile, permission, or group; and
the edges in the graph model represent relationships between the nodes, including at least one of a role assigned to a user, a role with a permission, or whether a user belongs to a group.
3 . The computer-implemented method of claim 1 , wherein the reviewing the segregation of duties is automatic based on the graphical representation.
4 . The computer-implemented method of claim 1 , wherein the business application concepts comprises at least one mission critical application.
5 . The computer-implemented method of claim 4 , wherein the mission critical application further comprises at least one of Enterprise Resource Planning (ERP), Customer Relationship Management (CRM), Supplier Relationship Management (SRM), Supply Chain Management (SCM), Product Life-cycle Management (PLM), or Human Capital Management (HCM).
6 . The computer-implemented method of claim 4 , wherein the providing comprises a plurality of graphical representations, wherein each of the plurality of graphical representations applies to a different one of the at least one mission critical application.
7 . A computer system for reviewing user access rights, comprising:
one or more processors configured to:
generate a model with nodes for business application concepts and edges for relationships between the nodes;
generate a graphical representation of the model including the nodes and the edges for reviewing the user access rights; and
review the user access rights based on the graphical representation;
wherein:
the user access rights comprise a segregation of duties;
to review the user access rights, the one or more processors is configured to review the segregation of duties based on the graphical representation, where reviewing the segregation of duties comprises a separate review for each of multiple groups of permissions to further identify conflicts; and
to review the segregation of duties, the one or more processors is configured to:
determine which users have access; and
determine how access is assigned.