Information Security and IT Director Support
Oversight’s Privileged User Monitoring and Audit (PUMA) solution provides a risk-based alternative for solving your SOX user privilege and management risks. Directors of Information Security and Technology now have real-time insight into the activities of all users of the business and financial systems. The Oversight PUMA solution monitors the heterogeneous enterprise as a single integrated processing domain. The advanced analytics monitor each user’s transactions in the context of their allowable and expected usage profiles within the financial system and associated databases. Oversight's PUMA solution also analyzes the user’s behavior within the context of the actual business process and specific policy framework. Information Security and IT Directors are notified only when a user, or privileged user, is involved in activities considered risky. This eliminates the time and energy required to query, print out and analyze audit logs.
Sample findings that characterize Oversight’s ability to distinguish questionable user behaviors in a variety of contexts:
|
Role |
Privileged Activity |
Sample Risky Behavior |
| P2P Manager |
Authority to maintain vendors, create and approve PO’s, approve vouchers, and authorize payments |
Use of privileges to perform more than one activity per end-to-end transaction (e.g., approve PO and payment for a single procurement) |
| GL Manager |
Authority to override privileges to manually modify ledger entries |
Use the override privilege to alter revenue or liabilities shortly before closing |
| PeopleSoft DBA |
Root, super user, access to the SAP database |
Modification of a payee name and account number just before a pay run |
| Systems Integration Lead |
Privileged accounts for use by the mutually dependent financial systems (allow read/write between applications) |
Major traffic type and volume deviation from the norm (human hijacking system account for elicit use) |
Achieving a Balance with Oversight
The key to a successful PUMA initiative is finding the right balance between operational necessity and potential user misuse and fraud, while managing the cost of complying with regulatory guidelines. Organizations need a risk-based approach based on the use of these privileges within the context of the user’s roles, responsibilities, processing norms, and allowable activities, to achieve this balance in the most efficient and least costly way. Oversight delivers the technology that allows you to focus on operational priorities and halt the escalation of your user management and compliance-reporting budget.
|
