SAP BusinessObjects Security - Remediation, or How to Find & Repair Gaping Holes in Your Current Security Model

For information on using APOS solutions to help you bolster and manage security, visit our more recent series of security posts.

By Rick Epstein

Ideally, you will want to plan your security architecture and design a bulletproof security model. However, sometimes assessment will uncover gaping holes in your current architecture, and you will want to close those holes as quickly as possible to reduce risk to your organization.

Here are the broad strokes for assessment and remediation. Keep in mind the best practices discussed in the previous post as you proceed through each of these steps:

1. Inventory groups and group members (users)
2. Look at each granular inherited & explicit permission for each principal for each content folder, universe folder, category folder, connection (connection folders in BI 4.x)
3. Are there any permissions set specifically on content within these folders?
4. Create groups for each application and apply the No Access to the Everyone group for each group on its respective application
5. Create groups for every content folder, universe folder, category folder, connection (connection folders in BI 4.x)
6. Apply the same security to each group on each folder
7. Create generic groups for specific grants or denials of rights
8. From your inventory of groups and users and permissions set for each, assign users to these new groups
9. Remove users from the old groups
10. Store the old groups in another group called something like "zzzToBeDeleted"

As I said, these are the broad strokes. They are a good start, but there remain traps for the unwary, and great potential for unintended consequences. If it reminds you of old mariners' charts with captions such as "There be dragons here," that may be a good thing.

Next in the security blogging series: Why companies don't update their security model.