A framework for separation of duties in an SAP R/3 environment

Managerial Auditing Journal

Volumn 18, Issue 5, 2003, Pages 419-430

  Little, Adam ^a   Best, Peter J ^b  

^a Waterfront Place   (Australia)

^b QUEENSLAND UNIVERSITY OF TECHNOLOGY   (Australia)

Author keywords

Access control; Enterprise resource planning; Financial accounting; Fraud; Security

Indexed keywords

EID: 84986037867     PISSN: 02686902     EISSN: None     Source Type: Journal    
DOI: 10.1108/02686900310476882     Document Type: Article

References (28)

1. Ahn, G.J. and Sandhu, R. (1999) “The RSL99 language for role-based separation of duty constraints”, Proceedings: Fourth ACM Workshop on Role-based Access Control, NIST, VA, pp. 43-54.
2. Albrecht, W., Howe, K. and Romney, M. (1984), Deterring Fraud: The Internal Auditor's Perspective, The Institute of Internal Auditors Research Foundation, Altamonte Springs, FL.
3. Arens, A.A. and Loebbecke, J.K. (2000), Auditing: An Integrated Approach, 8th ed., Prentice Hall, Upper Saddle River, NJ.
4. Ashton, R. (1974), “An experimental study of internal control judgements”, Journal of Accounting Research, Vol. 12 No. 1, Spring, pp. 143-157.
5. Ashton, R. and Brown, R. (1980), “Descriptive modelling of auditor's internal control judgements: Replication and extension”, Journal of Accounting Research, Vol. 18 No. 1, Spring, pp. 269-277.
6. Bertino, E., Ferrari, E. and Atluri, V. (1997), “A flexible model supporting the specification and enforcement of role-based authorizations in workflow management systems”, Proceedings: Second ACM Workshop on Role-based Access Control, NIST, VA, pp. 1-12.
7. Best, P., Mohay, G. and Anderson, A. (1997), “MIATA: A machine independent audit trail analyser”, Australian Computer Journal, Vol. 29 No. 2, May, pp. 57-63.
8. Carroll, J.M. (1987), Computer Security, 2nd ed., Butterworths, Stoneham, MA.
9. Clark, D. and Wilson, D. (1987), “A comparison of commercial and military computer security policies”, IEEE Symposium on Security and Privacy, IEEE Computer Society Press, Oakland, CA.
10. Davies, D.W. and Price, W.L. (1989), Security for Computer Networks, 2nd ed., Wiley, New York, NY.
11. Ferraiolo, D.F., Gilbert, D.M. and Lynch, N. (1992), Assessing Federal and Commercial Information Security Needs (USA), National Institute of Standards and Technology, Gaithersburg, MD.
12. Haelst, W. and Jansen, K. (1997), “Control & audit of SAP R/3 logical access security”, IS Audit & Control Journal, Vol. 3, pp. 37-44.
13. Hamilton, R. and Wright, W. (1982), “Internal control judgments and effects of experience: Replications and extensions”, Journal of Accounting Research, Vol. 20 No. 2, Autumn, pp. 756-765.
14. Kuhn, D. (1997), “Mutual exclusion of roles as a means of implementing separation of duty in role-based access control systems”, Proceedings: Second ACM Workshop on Role-based Access Control, NIST, VA, pp. 23-30.
15. Lunt, T.F. (1993), “A survey of intrusion detection techniques”, Computers & Security, Vol. 12 No. 4, pp. 405-418.
16. Moffett, J. (1998), “Control principles and role hierarchies”, Proceedings: Third ACM Workshop on Role-based Access Control, NIST, VA, pp. 63-69.
17. Peterson, H.E. and Turn, R. (1967), “System implications of information privacy”, Proceedings AFIPS Conference, Vol. 30, Spring, pp. 291-300.
18. Pfleeger, C.P. (1989), Security in Computing, Prentice-Hall, Englewood Cliffs, NJ.
19. Reid, B. (1987), “Reflections on some recent widespread computer break-ins”, Commun. ACM, Vol. 30 No. 2, pp. 103-105.
20. SAP AG. (1997), FI System Administration Guide Release 3.1, SAP AG, Walldorf.
21. Sandhu, R.S. (1998), “Role activation hierarchies”, Proceedings: Third ACM Workshop on Role-based Access Control, NIST, VA, pp. 33-42.
22. Sandhu, R.S. and Coyne, E.J. (1996), “Role-based access control models”, Computer, Vol. 29 No. 2, pp. 38-47.
23. Seeley, D. (1989) “Password cracking a game of wits”, Commun. ACM, Vol. 32 No. 6, pp. 700-704.
24. Smaha, S.E. (1988), “Haystack: An intrusion detection system”, 4th Aerospace Computer Security Applications Conference, Orlando, FL, December, pp. 37-44.
25. Spafford, E.H. (1989), “The Internet worm: Crisis and aftermath”, Commun. ACM, Vol. 32 No. 6, pp. 678-687.
26. Srinidhi, B. (1994), “The influence of segregation of duties on internal control judgements”, Journal of Accounting, Auditing & Finance, Vol. 9 No. 3, pp. 423-444.
27. Stoll, C. (1988), “Stalking the wiley hacker”, Commun. ACM, Vol. 31 No. 5, pp. 484-497.
28. Yin, R.K. (1989), Case Study Research: Design and Methods, rev ed., Sage, Newbury Park, CA.