Navision Security

Navaudit

Dear all,

The company that I am auditing now has set up its own security in Navision. They even declared a new "ALL" role, which means that all these permissions are attached to it. But I find something strange about the setup and cannot judge whether the setup contains a risk for the Company:

All / object (O, all rights)/ Table / Permissions: YES (read, insert, delete execute)
All / Object (O, all rights)/ Table data / Permissions: Indirect (read), YES (Execute)

Does this means that user are able to delete or modify tables if they wish? Ps: they recently switched from Native to SQL db

Could somebody provide me with an answer please, 8-[

Navaudit

Urmas

The Table permission gives access to table design. The access is furthermore restricted by System permissions of Design, Table, Basic and Design, Table, Advanced - eg if the user does not have these design permissions, he/she can not actually alter the design of the tables.

TableData permissions give access to data in the tables.
Giving a Indirect access to all data in tables is a potential risk as it quite difficult to ensure, that all objects (forms, reports, codeunits, etc) what are giving "missing half" of the permission are used only by authorized persons. It is always possible that a developer has accidentally given a permission to a form what is usable by everybody.
In current situation, the indirect permission to read data is not a threat to compromise data but users can potentially have access to data they should not see.