Who can log in to your ERP? An access review in one afternoon
Most ERP systems collect logins nobody remembers creating. A focused access review takes one afternoon and closes the gaps an auditor, or an attacker, would find first.
An ERP that has run for a few years usually carries a history: staff who left but kept their login, a shared account for the warehouse, an integration user with administrator rights because that was quickest at the time. None of it looks dangerous until someone uses it. An access review finds it in an afternoon.
Step 1: list every user
Export all users with their last login date and the access groups they belong to. In Odoo, this is the Users list under Settings, with the groups visible on each user. Include portal users and any technical users created for integrations.
Step 2: remove what should not be there
- users who have left the company
- users who have not logged in for 90 days, unless there is a clear reason
- shared logins used by more than one person, replaced with individual accounts
Step 3: check the powerful rights
- who has administrator or settings rights, and why
- who can approve purchases, validate payments or post journal entries
- who can delete records rather than archive them
In most companies, only a handful of people need any of these. Separate the person who creates a vendor bill from the person who pays it.
Step 4: check what people can see
Access groups decide which apps and menus people can use. Record rules decide which records they can see within them. In a multi-company setup, confirm that each user sees only their own companies, and that sales staff see only their own customers if that is your policy.
Step 5: secure the logins themselves
- turn on two-factor authentication for everyone with elevated rights; Odoo supports it in both editions
- set a password policy with a sensible minimum length
- review API keys and integration credentials, and rotate any that are old or shared
Make it routine
Write down what you found and what you changed, then repeat the review every quarter. The second review takes an hour, because the history has been cleared. Auditors like the written record almost as much as the result.
Comments