Oracle. L. Ladoga Rybinsk Res. Volga. Finland. Volga. Dnieper. Dnestr. Danube. Lesbos. Auditing Oracle Applications Peloponnesus

Transcription

1 N o r w e g i a n S e a White 60ûN ATLANTIC OCEAN UNITED KINGDOM Rio Douro Hebrid Bay of Biscay Garonne Faroe Isands Shetand Isands Orkney Isands North Loire ine Rhone Rhine Po Ebe Adriatic Batic Guf of Bothnia 60ûE Orace L. Ladoga Rybinsk Res. Guf of Finand Voga Appications: Voga Kuybyshev Res. The benefits of 50ûN 50ûE using automated of Azov audit toos Back 40ûN Dnestr Dnieper Dnieper Don Voga Don Kama Voga Corsica Tagus River Majorca Sardinia M e d i t e r r a n e a n S e a Wi Strait of Gibratar Drew and Anirvan Banerjee describe the use of Deoitte s OASIS software to audit Orace Security. Tyrrhenian Siciy Ionian Lesbos Auditing Orace Appications Peoponnesus Orace Aegean has a significant Rh odes presence in the UK pubic sector. Over 1,500 pubic Crete sector organisations use Orace software M e d i t e r r a n e a n S e a gobay. Within the UK, 11 of the Dead 13 major 0û 10ûE 20ûE 30ûE 0 systems, incuding SAP and Orace, Nie Red Euphrates R. government departments use Orace appications 1. The products are widey used, within both centra and oca government, to support financia, procurement and human resource processes. Enterprise Resource Panning (ERP) 500 Mies support integrated and automated business processes. 0These appications 500KM Parae scae at 45ûN 15ûE often contain the Genera Ledger and a number of integrated sub-edgers, incuding Fixed Assets, Accounts Payabe, Accounts Receivabe, Cash Management and Payro. Uniquey, the appication hods the account baances and aso supports the processing of underying transactions. The appication automaticay generates the financia accounting entries for each transaction, sometimes in rea time. Financia auditors need to consider the impact of the accounting system during audit panning. Since information is avaiabe eectronicay and not necessariy in hardcopy, the traditiona methods used to gather and evauate information may not be sufficient. Financia auditors often require more technica skis, or speciaist input from IT auditors. This is required to understand genera computer contros and the potentia impact of IT contros on the audit approach. A paradigm shift is occurring for a audit bodies, regardess of size and industry, to approach the audit from a financia, business process and information technoogy perspective. Importance of Security and Contros In our experience, an area often overooked in financia audits is Orace 30ûN security. The integrity of information 40ûE within Orace appications is critica. The financia reports produced by the system are reied upon by the organisation, their auditors and wider stakehoders, incuding other government bodies and utimatey the genera pubic. The accuracy and competeness of information hed in Orace appications depends on robust security and contros. However, many organisations strugge to get this right. The Nationa Audit Office (NAO) in the UK issued a discaimer of opinion in the audit report for the Home Office in The audit report referred to fundamenta probems in the accounting systems and significant contro weaknesses within key IT appications foowing a troubed impementation project. In addition to financia accounting risks, weaknesses in Orace security and contros can introduce operationa risks, such as expenses fraud, unauthorised data eakage and ate payments to suppiers. This can be damaging to the organisation s reputation

2 Common Security Weaknesses In our experience, many organisations strugge to impement robust security and contros. UK Orace User Group s magazine Orace Scene recenty pubished an artice written by Deoitte discussing the most common security weaknesses in Orace appications 3. A summary of the main issues raised in the artice is provided beow: Support team access is often excessive with many organisations using access profies that breach traditiona segregation of duties principes; Most organisations do not have defined segregation of duties poicies. Where segregation of duties principes have been defined, many organisations have no preventative or detective contros to enforce these principes; Orace does not provide standard reports to identify actua segregation of duties conficts 4. Few organisations have defined their own bespoke reports to address this issue; Few organisations configure auditing to capture changes to high risk information, such as suppier bank account detais; and Many organisations have not defined exception reports to monitor security exceptions or incidents. In addition to weaknesses at the appication eve, database security is another critica area which is often overooked. A information in Orace appications is hed in an underying Orace database. If the database is not adequatey secured, information can be accessed and modified directy at the database eve, by-passing a appication eve contros. Typica database security issues incude the use of generic user accounts, inadequate password contros and no auditing to monitor the activity of database administrators. 3 In Contro? Top 5 Common Contro Issues, Orace Scene Spring Segregation of duties reports are avaiabe through Orace s Governance Risk and Contro technoogy. However, these products are icensed separatey. 23

3 Chaenges Auditing Orace Security Figure 1: Generic User Names 2.4 Generic user names Observation Many audit bodies, incuding the NAO, are moving towards an integrated audit approach where speciaist IT audit work is performed to support financia audits. Due to the size and compexity of Orace systems, even quaified IT auditors can find it difficut to perform effective reviews of security and contros. Auditors often adopt a manua approach to auditing Orace, usuay conducting imited tests around genera computer contro areas, such as the enforcement of basic password contros. More advanced tests are difficut to perform due to the imitations in out-of-the-box reports The foowing tabe shows the user accounts where the user name or its description has been highighted as potentiay being generic accounts. This ist contains accounts that have TEMP, TEST, GUEST, USER or ADMIN in their user name or the user description. 15 of 82 users (18%) have not been end-dated and have generic user names or descriptions. USER_NAME DESCRIPTION USER_ID END_DATE APPSMGR User for routine maintenance activities schedued as concurrent requests. Shoud be used for pre schedued requests and for requests submitted at the time of patching appications. ASGADM asg deveoper user 2053 GEMINI Externa Consutant Orace Testing (read ony) 1301 GUEST guest 5 IBE_ADMIN istore Administrator 2078 IBEGUEST Guest User for istore 1985 IRC_EMP_GUEST irec Empoyee Guest Login 2005 IRC_EXT_GUEST irecruitment Externa Guest Login 2004 LLADMIN System Administrator User 1762 MOBILEADN asg mobie admin user 1965 RWALKER Contractor User 1004 SYSADMIN System Administrator 0 TEST_USER Test Account 2034 TRAININGUSER Used For Training 1682 WIZARD USER for Appication Impementation Wizard 6 This ist shoud be reviewed in conjunction with the Generic User Names and their Responsibiities section, which shows the high privieged responsibiities that have been assigned to these users. Risk Generic accounts that are not assigned to a specific individua remove accountabiity which increases the risk of fraud. Recommendation The ist of account names shoud be reviewed and where these cannot be identified to individuas they shoud be investigated and disabed where appropriate. Procedures shoud be impemented to contro the creation of temporary accounts or system accounts to ensure that they are set up with a unique ID and end-dated as appropriate. Management shoud perform periodic reviews to ensure that the process is foowed. provided by Orace and the technica compexity of the appication. Ironicay, these same chaenges often mean organisations that run Orace aso have a imited understanding of the status of their Orace contros. Where auditors do require a greater eve of assurance over Orace security and contros it is often resource intensive and requires significant invovement of the cient IT staff. For exampe, it may take severa days merging the resuts of severa different reports to obtain a ist of the users with access to enter journas. 3 Benefits of Automated Assessment Toos In recent years, a number of assessment toos have been deveoped to hep auditors review Orace environments. These toos overcome the issues of testing Orace security manuay. The common benefits of using these toos are: the toos are quick to run and require ess contact time with cient staff; the toos provide more detaied information than coud be obtained manuay; and the reports are written in non-technica anguage, so speciaist Orace IT Auditors do not need to be invoved. Utimatey, the use of automated toos can reduce audit costs whist increasing the audit coverage and quaity of vaue-added recommendations. Deoitte s OASIS Too OASIS (Orace Appication Security Integrity Suite) is the Deoitte UK proprietary too for Orace security anaysis. OASIS has been used to assess Orace security and contros at over 100 different organisations. The OASIS too generates three separate reports. The contents of the reports are isted in the inset boxes. The purpose of the reports is described beow: Orace Appication Security Report This report provides information about appication security, incuding the user account management, auditing and security configuration. The report is written in non-technica anguage and incudes sections discussing the observation, risk and recommendation for each section. Figure 1 shows the Generic User Names section of a sampe report. The findings in the report enabe auditors to hod foow up discussions with the Orace support team to investigate issues and identify the root cause of probems. For exampe, the presence of generic user accounts may indicate poor user administration processes, inadequate system monitoring or inappropriate use of the ive system for testing and training. Appication Security Report Contents: Generic User Accounts Last Login Dates Inactive User Accounts Password Contros Exceptions to Password Contros Users with Powerfu Access Users with Defaut Access Appication Auditing Other Security Configuration 24

4 Orace Database Security Report The database security report provides information about defaut passwords, database administrator s (DBA) accounts and database auditing. The format is the same as the appication security report. Figure 2 shows the Database Accounts with Defaut Passwords section of a sampe report. The presence of defaut database accounts may have a significant impact on security. The Orace defaut database passwords are easy to guess as the user name and passwords are the same. This information is widey avaiabe on the internet. Accessing the GL account woud provide fu read and write access to the database tabes that hod a the information in the Genera Ledger. This coud be used to modify accounting entries or create journas whist by-passing appication contros. Typicay, there is no reason why any defaut database accounts shoud have the defaut password but this is an extremey common finding. Database Security Report: Users with Defaut Passwords Password Contros DBA Accounts Database Auditing Other Security Configuration Access Contro and Segregation of Duties Matrix This report, provided in a spreadsheet format, provides detais of user access to Orace data entry screens, such as who can access the screens to Enter Journas or Create GL Accounts. This report can be used to investigate user access and determine whether appropriate segregation of duties have been enforced. This is particuary powerfu, as Orace does not provide standard reports that contain this information. Figure 2: Database Accounts with Defaut Passwords 2.2 Database accounts with defaut passwords Observation The foowing tabe shows defaut Orace database accounts with defaut passwords sti active on the system. A successfu attempt was made to ogin onto each of these accounts with their defaut passwords. The Key Account coumn indicates some of the key accounts these are typicay highy privieged Database Administrator eve accounts. The Database Owned coumn shows the accounts that are used by the Database Management System rather than by the appication system. ACCOUNTNAME SUCCESS KEYACCOUNT DATABASEOWNED ABM AP AR GL MDSYS POWER6_ALIUK POWER6_ALIUK_DUK SYS SYSTEM Risk A accounts with defaut passwords represent a risk at the very east they wi probaby have sufficient privieges to aow an intruder to perform a denia of service attack through fiing the avaiabe database space. At worst, if an intruder uses a highy privieged account, it may additionay aow users to change appication data directy and avoid a appication-eve auditing and privieges. This woud ead to poor decision-making and may ead to inconsistencies in the financia information. A users that have Orace have SQL*Pus instaed by defaut. This too aone woud aow any egitimate appications user to attempt to guess database account and password combinations, as woud Microsoft Access. Users do not have to be Database Administrators to have these toos avaiabe to them. Recommendation Each database account shoud have its password changed from the defaut. For appication-owned accounts this needs to be in two stages the first is to change the password through the Orace Appications system administrator function, the second is to change the database password at the database eve. If one of these stages is not performed, an inconsistency wi occur and probems wi arise. Management shoud impement a poicy such that a passwords are changed at east twice a year, with the passwords for key accounts changed at east every 90 days. Documentation shoud be maintained in order to confirm compiance with this procedure. 25

5 In the sampe report (Figure 3), we can see that the user ABANERJEE has access to enter and post journas. This woud be considered a segregation of duties confict in many organisations. The matrix can aso be used to identify muti dimensiona segregation of duties conficts. For exampe, some organisations may find it acceptabe for a user to enter and post journas provided they can not aso create GL accounts. In this situation, the access provided to JMANN is appropriate, whereas ABANERJEE and NYEOMANS breach this segregation of duties principe. The abiity to perform fexibe and customised segregation of duties anaysis makes the OASIS too extremey powerfu. The sampe report ony shows access to the Genera Ledger data entry screens. The report incudes access within a major business processes incuding procurement, payabes, receivabes, fixed assets, inventory, human resources and payro. Figure 3: User access to Orace data USER_NAME Number of privieged functions assigned to the user account Genera Ledger Enter Journas Import Journas Post Journas Reverse Journas Journa Authorization Limits Journa Categories Currencies Create GL Accounts Interfund Accounts Define Suspense Accounts Summary Accounts Archive and Purge Open and Cose Periods Enter Intercompany Transactions Numbers of users with access to the functions ABANERJEE 8 Y Y Y Y Y Y Y Y WDREW 2 Y Y NYEOMANS 3 Y Y Y JMANN 2 Y Y Wi Drew and Anirvan Banerjee Wi Drew and Anirvan Banerjee work in Deoitte s Orace Contros team which speciaises in assessing, impementing and optimising Orace EBS contros. This incudes working as part of Orace impementations to faciitate the incusion of good practice security and contros. This experience is aso used in performing Orace contro assessments and assisting organisations in improving and optimising their contros. They both reguary present at Orace User Group conferences and SIGs. They can be contacted at wdrew@deoitte.co.uk and anirbanerjee@deoitte.co.uk.