Arggghhh.... Look at Metalink Note 403537.1 - Best Practices for Securing Oracle E-Business Suite Release 12. It was last updated February 27, 2007. Yes... that is not a typo - 2007. The last update to this document was over three years ago. Is it possible that nothing has changed or nothing needed to be added to this document in over three years? Hardly the case. A lot has changed since then. New products have been launched and many new features have been added to existing applications. That SHOULD mean that new recommendations need to be added to the document - two obvious ones are new seeded database users and new seeded application users. We at ERP Risk Advisors have identified 10 new seeded application users {see Internal Controls Repository (for end users only) at: http://tech.groups.yahoo.com/group/oracleappsinternalcontrols/) for more on this topic}.
If Oracle is going to produce a best practices document it needs to maintain the document or provide a caveat stating that the document is a sampling of best practices that should not be relied upon as a comprehensive list. Just my two cents...
Email me with comments at jhare@erpra.net.
Regards,
Jeffrey T. Hare, CPA CISA CIA
ERP Risk Advisors / ERP Seminars
www.erpseminars.com
www.erpra.net
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment