ARMI - KN

Written by Connor Thompson, CIA, CISA

In NetSuite, standard roles present significant challenges related to sensitive access risks and segregation of duties (SoD) conflicts.

Why you ask? Because standard roles have many permissions that are not appropriate for that role. Many modules only have one standard role which does not allow for the assignment of secure roles to users. For example, standard roles such as the Accounts Payable (A/P) Clerk, Buyer, and Accounts Receivable (A/R) Clerk, are overprovisioned and assigned a broad range of permissions. These are modules they should not have access to. Over provisioned roles lead to excessive access risks and segregation of duties conflicts. Meanwhile, many of these will not be adequately managed through mitigating controls. Poor role design results in an increase of compliance, cyber security, fraud, financial reporting, data security, and operational risks.

From our Cyber Security technical expert, Connor Thompson, CIA CISA

There’s a Lack of Native MFA in ERP/HCM Cloud.

Oracle released this article in March highlighting the top cybersecurity threats and how to prevent them. In the article, they highlight the number one risk as “Business Email Compromise (BEC).”

The latest U.S. Securities and Exchange Commission (SEC) guidance on Cyber Security risks have “Cyber” firms buzzing.  Those that thought this would be the equivalent of Sarbanes Oxley must have been seriously disappointed.  There was no mandatory audit of Cyber risk included.

Organizations using SaaS Applications are encountering an increase in fraud risks that traditional cyber security firms are failing to recognize. Most organizations focus on protecting the perimeter and risks related to ransomware and data theft, leaving the organization vulnerable to attack in neglected areas. Internet facing applications such as ERP Cloud, NetSuite, and Workday allow easy access and administration in our work-from-home world. Properly securing the applications means far more than securing the perimeter.