SoD Policy

This is a landing page of SoD policy. From here, you can create a policy, add the owner and reviewer, set up the rules and run the SoD campaign. 

Take a look at the various columns of SoD policy and understand their significance:

SoD policy can be created for role, entitlement and application.

Create a SoD policy

1. Click +Add to create a new policy.
2. On this window, add the policy name, select to whom the policy applies and provide a description.
3. Click Add. The policy is added successfully.
4. Once the policy is created, you must add an owner and a reviewer for the policy.
5. Search the policy just created.
6. Select the policy to add/modify further details.

General tab

This tab has the basic information of SoD policy.

1. Policy Name: You can edit the policy name.
2. SoD policy is for: This is an uneditable field.
3. Description: Edit the policy rule set.
4. Send notification before Enter the number of days before which the SoD owner and reviewers must receive a notification to review the violation of SoD policy.
5. Click Save.

SoD Owner

Details of SoD owner and reviewer can be added/edited from here.

Add an Owner 

1.  Click SoD owner.
2. Click Add Owner to assign an owner to the policy.
3. Select a condition to match the results.
   • In the value field, enter the username and search.
   • Select an owner from the results.
4. Enter the number of Step Duration in days. If the step duration exceeds, the policy will be delegated to the reviewer selected in the next step.
5. Search with the username and select from the results.
6. Click Add.
   Note:

   In case, the current SoD owner is terminated or deleted from the system, an administrator must change the SoD owner.

Change Owner

The owner of the policy can be changed but not deleted.

1. Select the existing owner and click Change Owner.
2. Repeat the same from Step 3 as Add an Owner.
3. Click Change.

Add Reviewer

1. Click Add Reviewer to set up the reviewer.
2. In this window, enter the following details:
   • Reviewer Type: Select as Role/User from the drop-down.
   • Select a condition to match the results.
     • In the value field, enter the role name/username and search.
     • Select the appropriate role/user from the results.
   • Enter the number of Step Duration in days. If the step duration exceeds, the policy will be delegated to the reviewer selected in the next step.
   • Search with the username and select from the results.
   • Click Add.

Delete Reviewer

1. Select an existing reviewer name and click Delete Reviewer.
2.  Click Delete to confirm the deletion of the SoD reviewer.
3. SoD reviewer is successfully deleted.

Rules

A "rule set" in SOD (Segregation of Duties) refers to a collection of specific rules or policies that define the conditions under which access to certain resources (roles/applications/ entitlements) or systems is controlled. These rules are designed to ensure that users don't have access to combinations of permissions that could potentially lead to misuse or security breaches.

The rule set can be added for:

• Roles
• Applications
• Entitlements

Multiple targets of role/application/entitlement can be added to the rule set without any count limitation.

Add rule set for Application

1. Click Rules.
2. Click Add Rule.
3. Specify the Rule name.
4. Search the application name to add in Application Set 1 and Application Set 2.
5. Click Add and you can view the added policy.
6. Click View Details to see the application set details.

Add rule set for Roles

1. Click Rules > Add Rules.
2. Specify the Rule Name.
3. Search for the role name to add to Role Set 1 and Role Set 2.
4. Click Add and you can view the added rules.
5. Click View Details to see the role set details.

Add rule set for Entitlements

1.  Click Rules > Add Rules.
2. Specify the Rule Name.
3. Search the entitlement name to add to Entitlement  Set 1 and Entitlement Set 2.
4. Click Add and you can view the added rules. 
5. Click View Details to see the role set details.

SoD Campaign

There are two types of SoD campaign:

1. Online or real-time campaign: When you request access to a role/application/entitlement that is already a part of SoD policy, a warning prompt will inform you of the SoD violation.
2. Offline campaign: The action will be taken manually by the owner or reviewer in the offline campaign.

Let's look at the various function of the SoD Campaign:

1. Click SoD Campaign.
   
2.  Click Run SoD Campaign to initiate and evaluate the violations in the policy.
3. Click Run to confirm.
4. Click Run a Preview to evaluate the rules.
5. Click Proceed.
6. Click View Preview Result.
7. It shows the total number of violations, rule name and other details. 
8. Click View Details.
9. It shows the details of the SoD owner, pending, completed and the total number of violations.