KNOCKING THEIR SOX OFF

1. KNOCKINGTHEIR SOX OFF Mike Blum – Senior Systems Administrator michael_blum@superioressex.com

2. Answering Audit and Security Questions with the Click of a ButtonAGENDA BACKGROUND – How Does MFG/Pro Security Work NEED – What Questions Needed Answering SOLUTION – How Did Superior Essex Address the Need DISPLAY – System Demonstration LESSONS – What’s Coming in Phase 2

3. BACKGROUND MENU SECURITY USER SECURITY MFG/Pro Security has three components: GROUPS

4. User Security

5. User Security The number of groups assigned to an individual can be quite long. The user from the previous slide actually belongs to all of the groups listed below:

6. MENU SECURITY

7. MENU SECURITY Each Portion of a QAD Menu Can Have One or More Groups Associated With It. A User must be Authorized for each level to be approved FOR EXAMPLE: Menu 36.3.21.23.21 Browse UI Record Maintenance 36 – Manager Functions Mgr 3 - System Security Security, Pgmmaint, Sysaccon 21 - Desktop Security * 23 - Reports and Utilities * 21 - Browse UI Record Maint SMT, Sysacctcntl

8. QAD SECURITY: USER Security Groups USER usertom MENU Security Groups MENU 36.3.21.23.21 • 36 Mgr • 3 Security, Pgmmaint, Sysaccon • * • 23 * • 21 SMT, Sysacctcntl Acctng, Mgr, Finance, Security, SMT THIS PERSON WOULD BE ALLOWED ACCESS TO THIS MENU

9. QAD SECURITY: USER Security Groups USER userbob MENU Security Groups MENU 36.3.21.23.21 • 36 Mgr • 3Security, Pgmmaint, Sysaccon • * • 23 * • 21 SMT, Sysacctcntl Acctng, Mgr, Finance, Sysacctcntl SMT THIS PERSON WOULD NOT BE ALLOWED ACCESS TO THIS MENU

10. THE NEED FOR INFORMATION MFG/Pro Security Administrator: What Group Names have I created? Do I have any groups that are Obsolete? What Authorizations do I need to provide to give someone access to a menu? If I add a group to a User, what other functions have I given that person access to? If I add a group to a menu, who have I now authorized for that menu? Have I spelled all of the group names correctly?

11. AUDITING NEEDS: What Users have access to a particular menu or Function? What are all of the functions that a user has access to? Which Menus are open/Which are secured? Provide this information quickly.

12. SCOPE: Over 400 named users Over 3200 menu options = Over 1.28 Million possible entries

13. THE SOLUTION

15. The menu Information functions reveal how users are allowed access to specific menus

16. The User information functions prompt for a user id and identify the menus and groups associated with that user

17. Group information provides the layer that is not visible through MFG/Pro.

18. Additional Features • Intranet resident – No QAD log on required • Ability to view output online or via hardcopy • Segregated views based on user scope • (Auditor, Manager, Security Administrator)

19. Technical Features • Data is resident in MS-SQL Tables • Populated using an extract program and a DTS Package • Extract and load managed by job Scheduler • can also be initiated on-demand

20. DEMO

25. Project Benefits: Improved Accuracy Accountability Audit-friendly

26. LESSONS

27. Planned Enhancements: • Accommodate Multiple Systems • Provide Ability to Audit by “Top Level” QAD Menu Option • Obtain more user information from Active Directory

28. QUESTIONS