In NetSuite, permissions grant access to specific functions, defining exactly what users can see and do within the system. These fall into four main types: Transactions, Setup, Lists, and Reports. Each plays a unique role in shaping user access and safeguarding sensitive data. Understanding these categories is key to creating roles that not only fit specific job functions but also keep your environment secure and compliant.
Organizations are implementing new SaaS ERP systems to modernize their enterprise. Traditional cybersecurity risks are being outsourced to the software provider, yet certain cybersecurity risks still need to be addressed by management.
By implementing strong password policies and properly configuring password requirements in alignment with password policies, organizations can significantly reduce the risk of data breaches. These policies should include requirements for minimum password length, complexity, and regular changes. Ensuring users create and maintain strong passwords helps protect against brute-force attacks, social engineering attacks, dictionary attacks, and other common methods used by cyber criminals to gain unauthorized access.
Restricting integration accounts from having User Interface (UI) access in NetSuite is a critical security measure. This restriction protects an organization’s data and systems from potential vulnerabilities. Integration accounts are designed to facilitate seamless data transfer and automation between NetSuite and other applications to perform essential functions without human intervention. Allowing these accounts UI access poses security risks and operational challenges.
Most organizations have mature processes and controls related to preventing a breech on their internal systems – what we refer to as “securing the perimeter.” The thought being: Keep the bad guys out of our network and our data is protected. Or at least management assumes this is the case.
Why you ask? Because standard roles have many permissions that are not appropriate for that role. Many modules only have one standard role which does not allow for the assignment of secure roles to users. For example, standard roles such as the Accounts Payable (A/P) Clerk, Buyer, and Accounts Receivable (A/R) Clerk, are overprovisioned and assigned a broad range of permissions. These are modules they should not have access to. Over provisioned roles lead to excessive access risks and segregation of duties conflicts. Meanwhile, many of these will not be adequately managed through mitigating controls. Poor role design results in an increase of compliance, cyber security, fraud, financial reporting, data security, and operational risks.
Having been in the Security and Controls space for far too long, I have witnessed and am still witnessing a phenomenon that needs to be addressed. Auditors talk WAY too much about Segregation of Duties.
Oracle ERP / HCM Cloud is an evolving suite of applications. Most organizations that consider implementing an ERP/HCM Cloud likely believe the “foundation” of the applications are solid. Unfortunately, that is not the case. We currently track over 200 enhancement requests that we, and others, have submitted. However, there are some significant gaps for public and private organizations, especially those that need this highest level of security via Oracle’s FedRamp offering.
From our Cyber Security technical expert, Connor Thompson, CIA CISA
Oracle released this article in March highlighting the top cybersecurity threats and how to prevent them. In the article, they highlight the number one risk as “Business Email Compromise (BEC).”