Polski (PL) 
English (United Kingdom) 
TL;DR (Too Long; Didn't Read)
- The Problem: Routine IFS Cloud implementations suffer from "Permission Bloat" because over-privileged users and cloned sets fail ISO/SOC audits.
- The Solution: Implementing a Granular Access Control matrix based on functional roles rather than legacy user habits.
- Key Outcome: Audit-ready security that enables the "Moment of Service" for mobile users without exposing core financial or HR data.
- Service Focus: Permission Sets Mastery & SoD Matrix Design.
What Problem Does This Article Solve?
Many organizations treat ERP security as a technical afterthought. This leads to Security Debt: a state where the system is so cluttered with "cloned" permission sets and administrative overrides that it becomes impossible to pass a modern compliance audit (ISO 27001, SOC2). This article provides the blueprint for transitioning from "Permissive Security" to "Enabled Security," ensuring your IFS Cloud environment is a business asset rather than a liability.
1. Common Security Pitfalls in IFS Cloud Environments
In the transition from legacy versions like IFS Applications 9 or 10 to IFS Cloud, many technical teams take the path of least resistance. This path is littered with vulnerabilities.
The Danger of "Cloned" Permission Sets
The "Clone" button is the most dangerous tool in an administrator’s arsenal. When a new user needs access similar to an existing one, admins often clone a massive permission set. Over time, this creates a "Snowball Effect" where privileges are inherited but never revoked. In an Evergreen environment like IFS Cloud, legacy clones may not support new security checkpoints in R1/R2 releases, leading to system instability or hidden backdoors.
"Cloned permission sets are the technical debt of the security world. They provide a quick fix today but create a forensic nightmare for auditors tomorrow."
Over-Privileged Users and "God Mode"
Nearly 20% of users typically hold full system access because it simplifies their daily tasks. These over-privileged users represent a primary target for credential harvesting. IFS Cloud exposes the OData provider along with REST APIs. Excessive permissions create risks for the user interface. They threaten the entire database layer.
2. Designing a Granular Access Control Matrix for ISO Compliance
To satisfy an ISO 27001 or internal auditor, you must prove The Principle of Least Privilege. This requires a shift to a robust Role-Based Access Control (RBAC) model.
Step 1: Functional Mapping
Do not map permissions to people; map them to business processes. Identify the "Functional Roles" (e.g., Accounts Payable Clerk, Warehouse Supervisor, Maintenance Technician). Each role should have a dedicated permission set that only includes the Projections, Pages, and Actions required for that specific process.
Step 2: Defining the Base Profile
Every user should inherit a "Global Base" set. This includes non-sensitive access: viewing the employee lobby, basic document management, and personal time reporting. By separating the Base from the Role, you simplify the audit trail.
Segregation of Duties (SoD) in IFS Cloud
A critical component of your matrix is the SoD Matrix. In IFS Cloud, you must ensure that the user who creates a Supplier cannot also Authorize a Payment. We utilize the IFS Cloud Security Dashboard to monitor these conflicts in real-time. Our Permission Sets Mastery service includes the pre-configuration of these SoD rules to ensure you are "Secure by Design."
| Requirement | Implementation in IFS Cloud | Audit Evidence |
|---|---|---|
| Identification | Identity Management (IAM) Integration | SAML/Azure AD Logs |
| Authorization | Projection-Based Permission Sets | Security Grant Reports |
| Accountability | History Log Configuration | Audit Trail of Record Changes |
3. Security and the "Moment of Service": The Mobile Frontier
IFS Cloud supports the Moment of Service. This describes the point where a technician or consultant interacts with a customer. These interactions frequently take place on a mobile device such as IFS Service Drive or Scan It.
Balanced Mobile Security
The challenge is providing enough access for a field technician to complete a work order without giving them access to the company's financial balance sheets. We solve this by designing "Mobile-First" permission sets. These sets focus on Offline Data Sync security. You must control which data is cached on the device and ensure that when a technician leaves the company, their access is revoked globally via the IAM (Identity and Access Management).
The Connection Between UI and API
In IFS Cloud, the Page Designer allows us to hide fields, but Hiding is not Securing. True security happens at the Projection level. Even if a field is hidden on a mobile screen, a savvy user could theoretically access it via an OData call if the underlying projection is not secured. Our methodology ensures that the back-end API access matches the front-end user experience.
4. Why CIOs and CISOs Choose Permission Sets Mastery
Security is often seen as a "No" department. Our goal is to turn it into an "Enable" department. By having clean, audit-ready permission sets, the business can move faster. New employees are onboarded in minutes, not days. Software updates (the Evergreen cycle) become predictable because we know exactly which roles are impacted by new features.
- Reduced Risk: Eliminate unauthorized data exports.
- Audit Readiness: Go into your annual audit with confidence and documented proof of SoD.
- Lower Maintenance: Fewer, higher-quality permission sets mean less work for your IT team.
Stop Guessing Your Security Status
Don't let "Permission Bloat" compromise your IFS Cloud implementation. Secure your data, satisfy your auditors, and empower your mobile workforce.
Book an IFS Cloud Security Audit