Skip to content

Security Audit

Review who can access which BusinessObjects folders and objects, find risky or stale grants, compare security between environments, and trace who changed rights.

Goal

An auditor asks: who can see the Finance folder, which users have administrator rights, which accounts have not logged on for months, and who changed the rights on a folder last quarter? You answer from MetaMiner metadata instead of clicking through the CMC object by object.

Who

BI administrators, security officers and internal auditors (read-only).

Before you begin

  • MetaMiner collects security metadata for the environment. To include access levels per user and group, select Retrieve Access Level Metadata in MMA (Preferences > Settings > Pull). See Pull settings.
  • For change history (who changed rights), MetaMiner collects audit data. See Audit and CMS Databases.
  • You have the MMC permissions Explore Security, Tab: Security Diff and Tab: Meta Query as needed. An auditor can be given a read-only MetaMiner role. See Users and Roles.

Steps

Who can access a folder or object

  1. In the CMS Explorer, right-click a folder or object and choose Explore Security, then the selection only or the selection with its children.
  2. Review the access levels and rights per user and group in the security tab that opens. See Explore Security.
  3. For an answer in a browser, open the Security and Exposure dashboard of the Web Console and search by folder or by principal.

Image of the security tab opened by Explore Security on one folder here

../images/use-cases/security-audit-explore-security.png

Who belongs to which group

  1. Open the Users tab and select a user or group to see memberships. See Users and Groups.
  2. For nested-group questions, run IK-023 or IK-024 from the SQL Script Catalog.

Find risky and stale grants

  1. In the Web Console Security and Exposure dashboard, review the hygiene, stale security and authentication mix views.
  2. Run IK-003 (access levels and included rights by group) and IK-054 (security view down to each right) in Meta Query and export the result for the audit file.

Compare security between environments

  1. Open the Security Diff tab.
  2. Choose the same folder or object in two environments (for example production and disaster recovery) and compare. See Security Diff.

Trace who changed rights

  1. Right-click the object and choose View Audit History.
  2. Run IK-017 (rights and custom access level changes) or IK-009 (last 24 hours of activity) in Meta Query.
  3. For a report, use MM-A02 User Activity Summary and MM-A03 Event Details.

Expected result

An exportable record of who can access each sensitive folder, which grants are stale or excessive, how security differs between environments, and who changed it, all without changing anything in BusinessObjects.

Variations

  • Fix what you found: MetaMiner can change access levels, user group membership and user status from the MMC (permissions Change Access Level, Modify User Group Assignments, Disable User). Back up the security first; see Disaster Recovery.
  • Disable inactive users on a schedule: create an Alert of type SQL Script that selects the users and uses Disable Users. See Alerts.
  • MetaMiner's own access control: see Security Model.

Next steps