Reducing the Cost of Compliance in JDE World

Reducing the Cost of Compliance in JDE World & E 1 Effective Security Compliance Solutions Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Reducing the Cost of Compliance in JD Edwards World & Enterprise. One

Effective Security Compliance Solutions Security compliance solutions for JD Edwards www. qsoftware. com Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Be in control. Use Q Software

Effective Security Compliance Solutions • How you can enhance your security 8 reduce your cost of compliance 8 Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Today, we will show you…

Effective Security Compliance Solutions • • • About Q Software The Compliance Life-Cycle Reducing the Cost of Compliance: World Reducing Cost of Compliance: E 1 Customer Case Study Summary Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Agenda

Effective Security Compliance Solutions • Committed to JDE security 8 That is ALL we do & have done so for 10 years • Innovative 8 Patent pending • Continuing to invest in JDE Security 8 Comprehensive product development roadmap 8 SEC-Qure™ family released at Open. World 2005 New versions announced at Collaborate 2006 8 New versions released for Open. World 2006 8 • 180 customers 80% in USA 8 Past 12 months: 45% from Canada + Europe 8 • Based near London, UK Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One About Q Software

Effective Security Compliance Solutions With more than 35, 000 members in more than 100 countries, the Information Systems Audit and Control Association (ISACA®) is a recognized worldwide leader in IT governance, control, security and assurance. Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Q Software Alliances

Reducing the Cost of Compliance in JDE World & E 1 Effective Security Compliance Solutions Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Q Software Customers

Effective Security Compliance Solutions • • • About Q Software The Compliance Life-Cycle Reducing the Cost of Compliance: World Reducing Cost of Compliance: E 1 Customer Case Study Summary Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Agenda

Effective Security Compliance Solutions • SOX section 404 requires organisations to state… 8 “the effectiveness of the internal control structure” • SOX section 202 mandates 8 “frequent testing and validation of internal controls is essential to quarterly confirmations of their effectiveness. ” • New security & data privacy laws • According to auditors: SOD controls are paramount 8 Effective controls makes sound business sense 8 0 Regardless of the regulatory need Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Business need for security: - Corporate Governance (SOX)

Effective Security Compliance Solutions • Corporate Governance regulations result in four main tasks, companies have to fulfil in order to comply with the important and most frequently addressed requirements. R Mana isk geme n al Internrol nt Corporate Governance Audit Committe e g Reportin nts e Requirem Internal Control Risk Management Corporate Governance Audit Committee Reporting Requirements tomorrow today Fragments of CG components exist in the company. Reducing the Cost of Compliance in JDE World & E 1 Integration of CG components avoids redundancy and allows efficient compliance with laws and regulations. Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Company requirements

Effective Security Compliance Solutions Auditing Analysis 10 years Compliance Reporting Security Management Segregation Of Duties Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One The Compliance Life Cycle

Effective Security Compliance Solutions • • • About Q Software The Compliance Life-Cycle Reducing the Cost of Compliance: World Reducing Cost of Compliance: E 1 Customer Case Study Summary Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Agenda

Effective Security Compliance Solutions • The Requirement 8 Who can access what? 0 And how? What else can they access once there? 8 Which critical programs can be accessed by whom? 8 0 And how? • The Problem 8 Almost impossible manually 0 0 Menu security set-up is complex Over 150, 000 menu connections Back-door access 8 Reporting is VERY time-consuming 8 “After the event” analysis – too late! 8 0 If fraud discovered, damage is done! Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Access Analysis

Effective Security Compliance Solutions • Recommended by Oracle • Recommended by auditors • The Problems World only allows single roles 8 Limits flexibility 8 No simple tools to manage roles 8 Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Roles-based Security

Effective Security Compliance Solutions • The Requirement Define, Manage & Report So. D Rules 8 Report on Conflicts 8 Address or Apply Compensating Procedures 8 • The Problems Volume / Complexity of Controls 8 Analysis of “True” Access for Conflicts 8 Enforcing / Maintaining Security Policy 8 Compensating controls may be expensive 8 0 0 Manpower Money Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One So. D Controls

Effective Security Compliance Solutions • The Requirement 8 Regular / Continual Testing 0 0 0 8 Who has access to what? Which critical programs can be accessed by whom? What else can they access once there? Reporting for auditors 0 If tests not recorded, they “did not happen” • The Problem 8 Analysis impossibly complex 8 Reporting VERY time-consuming 8 On-going commitment Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Compliance Reporting

Effective Security Compliance Solutions • The Requirement Reports – from regular testing 0 Who has access to what? 0 Which critical programs can be accessed by whom? 0 What else can they get at once in a program? 0 SOD conflicts / breaches - Fraud MUST be investigated 8 Data extractions for off-line analysis 8 • The Problem Very time-consuming 8 Difficult to prove compliance 8 The bar will be raised year-on-year 8 Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Auditing

Effective Security Compliance Solutions But function keys & lower level allow access to all these Menu security allows user Shane 73 access to 5 programs only. Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Exposures – What programs can a user access?

Effective Security Compliance Solutions Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Exposure: Who can access critical programs?

Effective Security Compliance Solutions Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Demo: How can a user access a program?

Effective Security Compliance Solutions There are over 1, 000 routes into the Voucher Entry program P 04105. Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Exposures: How can a user access a program?

Effective Security Compliance Solutions Audit • Prove compliance Set up JDE Group Profiles Reporting • Security settings • Access analysis Maintain Security • Staff / Role changes • Organisation changes (Re)-Assign Users to Roles Create Roles from Group Profiles JDE World SEC-Qure™ World. SOD SEC-Qure™ World. Analyser Allocate Security For each Group Apply So. D rules / functions inside World Identify all Access Routes SEC-Qure™ World. Config Check So. D Conflicts Modify JDE Security Reducing the Cost of Compliance in JDE World & E 1 In-depth Access Analysis Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Integrated World Security Compliance

Effective Security Compliance Solutions Simple Solutions for Complex Problems JD Edwards World and Enterprise. One recommends "Q Software is a long-term JD Edwards World business partner and they have been providing security solutions for our customers for over 10 years. They thoroughly understand World security and continue to offer comprehensive security solutions which methodically complement ours. " -John Schiff VP & GM, JD Edwards World “We recommend Q Software to our customers. " -Denise Grills Director Strategy & Marketing, JD Edwards World Reducing the Cost of Compliance in JDE World & E 1

Effective Security Compliance Solutions Powerful Analysis Comprehensive Reporting “Find and Fix” Compliance easy to prove Comprehensive Reporting Historical (Roles) Audit Trail Unique Multiple Roles map to Business Process Dynamic Security Assignment Simple & Effective Integrated into World Combines with Roles for SOD Enforcement • Reduces analysis & reporting effort • Reduces security maintenance effort • Reduces risk Only truly secure approach 8 And maps security to the business processes 8 • Compliance easy to prove Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One SEC-Qure™ World Reducing Compliance Costs

Effective Security Compliance Solutions “If asked to provide information on who can update data in a program, I can provide this the same day by updating access information and viewing the information in two-five strokes, instead of several days research and running queries, which would have taken me literally thousands of keystrokes. I see the greatest savings is time which then equals money” “I needed to identify and apply Action Code Security to critical programs – Q Software is the only way. ” “I wholeheartedly recommend Q Software security to other World installations. I would certainly buy again – only this time I’d buy it and use it from Day One!” Coachmen Industries “the man hours and dollars saved justified the investment” “I don’t know how people cope without Q Software” Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Q Software World Customers

Effective Security Compliance Solutions • • • About Q Software The Compliance Life-Cycle Reducing the Cost of Compliance: World Reducing Cost of Compliance: E 1 Customer Case Study Summary Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Agenda

Effective Security Compliance Solutions • • Compliance requirements remain the same Architectures / functionality are different Challenges & issues are different Allows a different approach Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One E 1 has different issues to World

Effective Security Compliance Solutions • All Doors Closed “Only way to ensure a fully auditable system” 8 Granting back access fraught with risk 8 0 8 Using standard E 1 Need to build a maintainable model 0 Sustainable compliance Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One E 1 Security Fundamentals

Effective Security Compliance Solutions Multiple Roles Auditability Solution Explorer Row Security SOD Maintenance Repetition Associated & Hidden Progs Volume 29, 000 objects Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One: Frequent Security Headaches

Effective Security Compliance Solutions The Problems • Average of 10 exits per program • New Hidden Programs introduced Via Service Packs 8 Upgrading to new versions 8 Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Associated & Hidden Programs

Effective Security Compliance Solutions Hidden Programs Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Example of Hidden Programs

Effective Security Compliance Solutions • Problem with interaction between roles • Sequence Manager defines “level of security” Audit problems – which role caused what access? 8 Creates SOD nightmare 8 Change a role – introduce unknown access model 8 Concatenation of security can cause lock-out 8 “ our security admin manager changed a role and locked himself out!” - A customer who wishes to remain anonymous! Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Multiple Roles: The Problem

Effective Security Compliance Solutions P 01012 Action Code Security OK/Select = Y, All other Actions = N P 01012 Action Code Security Delete = N, All other Actions = Y • Sequence Number assigned when role added • Greatest number takes precedence in conflict situation Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Added Roles are assigned Sequence Number

Effective Security Compliance Solutions Delete = N, All other Actions = Y Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Resulting Level of Access is as intended

Effective Security Compliance Solutions P 01012 Action Code Security Delete = N, All other Actions = Y P 01012 Action Code Security OK/Select = Y, All other Actions = N • Change required for other hierarchical reasons • Could result in additional unexpected security model changes Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Role Sequence Change

Effective Security Compliance Solutions Add / Copy no longer available Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Undesirable Consequence

Effective Security Compliance Solutions A/P Voucher Clerk Secondary Role 2 Component 2 Secondary Role 3 Component 3 Reducing the Cost of Compliance in JDE World & E 1 A/P “Super” Voucher Clerk Role Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Simplifying Multiple Roles in SEC-Qure™ E 1 Config

Effective Security Compliance Solutions • Don’t worry 8 SEC-Qure™ E 1 Config alerts you to problems Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One If you really do need multiple roles…

Effective Security Compliance Solutions • 29, 000 objects • Several hundred thousand lines of security 8 Potentially millions • Errors • Oversights Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One The Volume & Maintenance Problem

Effective Security Compliance Solutions • Solution Explorer is now mandatory • No link between Solution Explorer Tasks and Security • Much effort is duplicated Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One The Solution Explorer Problem

Effective Security Compliance Solutions Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Demo: Security from Solution Explorer Tasks

Effective Security Compliance Solutions Compliance easy to prove Comprehensive Reporting Simple & Effective Checked whenever security changed Easy enforcement of SOD policy Simple Reports Associated & Hidden programs Re-usable Components Links Solution Explorer to security Multiple Roles Management • Reduces security set-up by 80% • Reduces security maintenance by 50% • Reduces Analysis & Reporting Effort from days to minutes Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One SEC-Qure™ E 1 Config Reducing Compliance Costs - ADC

Effective Security Compliance Solutions “In my previous company it took about 15 -18 man months of effort to set up the JDE security manually. Here, using Q Software, it took around 2 man months. ” “Using Q Software, the security tasks for the first implementation phase took four weeks – around 85% reduction on the original estimate of six months without Q Software. ” “It was estimated that the software would achieve as much as a 50% reduction in the workload of maintaining security. ” “Q Software enabled us to undertake the security aspects of Enterprise. One in-house and saved us the expense of employing an external consultant” “Previously it took at least four hours to set up new groups, but with Q Software that time has been reduced to about 15 minutes. ” Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One What you tell us

Effective Security Compliance Solutions • • • About Q Software The Compliance Life-Cycle Reducing the Cost of Compliance: World Reducing Cost of Compliance: E 1 Customer Case Study Summary Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Agenda

Effective Security Compliance Solutions • Situation Engineering & Construction Industry 8 Private & Public Sector clients 8 Believes in good corporate governance 8 0 For long-term benefit of the company But SOX was the ultimate driver 8 2, 000+ heavy users 8 8, 000 occasional users 8 • The Problems Managing the 8, 000 occasional users 8 Many security short-comings 8 Effort / Cost required to manage security 8 Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Customer Case Study

Effective Security Compliance Solutions • The Impact of the Problems 8 “Unhealthy” audit 0 8 Potential impact on business, especially government High audit costs 0 Many deficiencies to be investigated Security management costs were very high 8 Exposed to fraud potential 8 Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Customer Case Study

Effective Security Compliance Solutions • The Need 8 8 8 Make security more manageable Make compliance more sustainable Reduce the cost & effort involved Implement tighter SOD controls Become compliant / pass the next audit Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Customer Case Study

Effective Security Compliance Solutions • SEC-Qure™ World. Analyser 8 Analysed short-comings / exposures 0 8 Back-door access etc Identified magnitude of the problem • SEC-Qure™ World. Config Enabled multiple roles-based security model 8 Cut 8, 000 occasional users down to 150 roles 8 User’s security changes dynamically 8 0 when new role selected • SEC-Qure™ World. SOD 8 8 8 4½ M O N T H S SOD rules integrated into World 5 different Severity Levels attached to different rules Security Officer warned of potential violations when assigning roles or changing role security Report on any breach in the security set-up 900 rules 0 Agreed with auditor Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Customer Case Study: The Solution

Effective Security Compliance Solutions • The Benefits 8 Significant reduction in security management effort 0 0 8 Set up a new user in 10 minutes Add security for new country – 20 minutes! Reduction in audit costs 0 0 Both internal & external auditors “love it” Easy to test, prove & report on compliance Easy to identify potential SOD violations 8 Easy to report on roles 8 0 0 8 Set-up Security Assignments Audit trail of assignments / adoption Passed the 2006 audit 0 “as different as night and day” Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Customer Case Study

Reducing the Cost of Compliance in JDE World & E 1 Effective Security Compliance Solutions Simple Solutions for Complex Problems JD Edwards World and Enterprise. One “We could not have achieved this without Q Software’s SEC-Qure integrated security compliance solutions. ”

Effective Security Compliance Solutions • • • About Q Software The Compliance Life-Cycle Reducing the Cost of Compliance: World Reducing Cost of Compliance: E 1 Customer Case Study Summary Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Agenda

Effective Security Compliance Solutions Security compliance solutions for JD Edwards www. qsoftware. com Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Security a head ache? Use Q Software

Effective Security Compliance Solutions • Compliance requirements remain the same • Challenges & issues are different • Allows a different approach • Q Software can reduce Co. C at every stage Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Summary: Reducing Cost of Compliance

Effective Security Compliance Solutions • For a copy of the presentation or white papers • Email: info@qsoftware. com • To book a Webinar • Visit www. qsoftware. com/events. htm Reducing the Cost of Compliance in JDE World & E 1 Simple Solutions for Complex Problems JD Edwards World and Enterprise. One For more information

Reducing the Cost of Compliance in JDE World & E 1 Effective Security Compliance Solutions Simple Solutions for Complex Problems JD Edwards World and Enterprise. One Question ?