What is the fundamental concept behind the rule of least access? Explain why this is a potential problem in an ERP environment
Access privileges (permissions) should be granted on a need to know basis only. Nevertheless, ERP users tend to accumulate unneeded permissions over time. This is often due to two problems:
(1) Managers fail to exercise adequate care in assigning permissions as part of their role granting authority. Since, managers are not always experts in internal controls they may not recognize when excessive permissions are awarded to an individual. (2) Managers tend to be better at issuing privileges than removing them. As a result, an individual may retain unneeded access privileges from a previous job assignment that creates a segregation of duties violation when combined with a newly assigned role.
You might also like to view...
There is evidence that the response to a question is influenced by the directionality of the question
Indicate whether the statement is true or false
_____________ are liabilities that arise from a contract that requires a company to make payments to its employees after they retire
A) Deferred income taxes. B) Other post-retirement benefits. C) Capital leases. D) Pensions.
The only required sections of a PL/SQL block are DECLARE and END.
Answer the following statement true (T) or false (F)
If a group of employees is represented by a union and another union that has a better track record also wants to represent those workers, the employees:
A. Can choose to belong to both unions. B. Can immediately switch unions. C. Can file for a decertification election whenever enough workers say they want one. D. Must stick with the union they have until the contract expires.