Login
Register
Search
Home
Forums
Jobs
LawsonGuru
LawsonGuru Letter
LawsonGuru Blog
Worthwhile Reading
Infor Lawson News Feed
Store
Store FAQs
About
Forums
General
SOx Compliance
Lawson Admin Segregation of Duties
Home
Forums
Jobs
LawsonGuru
LawsonGuru Letter
LawsonGuru Blog
Worthwhile Reading
Infor Lawson News Feed
Store
Store FAQs
About
Who's On?
Membership:
Latest:
raghu
Past 24 Hours:
0
Prev. 24 Hours:
0
Overall:
5150
People Online:
Visitors:
333
Members:
0
Total:
333
Online Now:
New Topics
IPA/ProcessFlow
WFWORKUNIT table, WF-STATUS field value set
7/25/2024 8:51 PM
documentation I can find has values for this field
Lawson S3 HR/Payroll/Benefits
Benefit change/termination reules
7/23/2024 2:22 PM
Can old benefit change/termination rules rules be
IPA/ProcessFlow
this.bean is null
7/19/2024 5:42 PM
Getting this error when my IPA gets to the second
IPA/ProcessFlow
Converting UTC Date to EST Date using Javascript
7/16/2024 2:53 PM
I'm looking for how others are performing a co
S3 Systems Administration
Changing the orgs email domain
7/12/2024 8:44 PM
Hello! We're changing our email
Dealing with Lawson / Infor
Managing List Views
6/20/2024 4:44 PM
I have list views in both PO13.3 and IC11 that are
Lawson S3 Financials
PO Matched Dollars and Matched Quantity
5/10/2024 6:51 PM
Can anyone share the Lawson calculation to determi
S3 Customization/Development
COBOL CSV file
5/10/2024 2:36 PM
We have a custom Cobol program ZU200 that creates
S3 Systems Administration
Using MFA for Lawson S3 Access
5/8/2024 1:23 PM
Does anyone use Multi Factor Authentication when u
IPA/ProcessFlow
Executing IPA from PR160
5/3/2024 2:46 PM
We're facing a situation where we need to upda
Top Forum Posters
Name
Points
Greg Moeller
4184
David Williams
3349
JonA
3291
Kat V
2984
Woozy
1973
Jimmy Chiu
1883
Kwane McNeal
1437
Ragu Raghavan
1360
Roger French
1312
mark.cook
1244
Forums
Filtered Topics
Unanswered
Unresolved
Announcements
Active Topics
Most Liked
Most Replies
Search Forums
Search
Advanced Search
Topics
Posts
Prev
Next
Forums
General
SOx Compliance
Lawson Admin Segregation of Duties
Please
login
to post a reply.
3 Replies
0
Subscribed to this topic
10 Subscribed to this forum
Sort:
Oldest First
Most Recent First
Author
Messages
Leonard Courchaine
Veteran Member
Posts: 55
6/3/2014 5:28 PM
We're being pressured by auditors about breaking up into two the Lawson Admin who puts something (mod/CTP/Env Patch) into our Test environment and the Admin who puts it into Production.
Our practice has been:
1. Dick puts quarterly patches into test; Harry puts environment patches into test.
(user testing occurs)
2. Dick then puts quarterly patches into prod; Harry puts environment patches into prod.
(All Lawson Admins have keys to test and prod e.g. the lawson password.)
Auditors would like it if PersonA puts something into test and PersonB then puts it into production with Person A not having the ability to access production. Same with new custom mods that we put in.
We'd **LOVE** to know how others are dealing with this type of auditor request around segregation/separation of duties with limited resources.
Thanks so much,
Lenny
Kwane McNeal
Veteran Member
Posts: 479
6/4/2014 2:43 PM
Lenny,
If you have one or two, and no more than two admins, typically I have seen clients do some variation to the following:
1) Document an audit exception, because the point of having two admins is one is a backup to the other. If you segregate one from PROD completely, you lose some of the benefit to fall back.
2) Setup a system to audit access to both the 'root'/'administrator' and 'lawson' accounts, by using 'su' (for UNIX), or some type of OTP (for Windows). Direct 'root'/'administrator' and 'lawson' access is forbidden, and the logs are sent to some other server the admins don't have access to.
Kwane
Tim Cochrane
Veteran Member
Posts: 154
6/6/2014 1:55 PM
Agreeing with Kwane - we've got a team of 5-7 System Admins: 5 on-site; 2 off-shore. ALL are expected to be able to handle ALL environments...otherwise they are worthless They typically work in pairs; one to make the changes and the other to validate.
We're a large health care organization, so we've have to follow the same SOX requirements that you do. I don't know if our LSAs have to report anything to IA...never heard of them doing that...but our IA is comfortable with the process. Our Lawson Security group DOES have to make periodic reports to IA, so that might include any LSA activitiy, but i think the Security report is more around role/classes/user changes in LS.
Kwane's worked with us before, he's seen how our system works.
Leonard Courchaine
Veteran Member
Posts: 55
6/10/2014 1:33 PM
Guys,
Thanks ***very*** much for your input. I'll pass it along. Seems very reasonable.
Lenny
Please
login
to post a reply.