RISE provides the opportunity for SAP Basis administrators to focus on higher value activities. Cybersecurity (or information security, depending on one’s career trajectory) grew out of infrastructure, network, and system integration into its own practice of managing security and compliance risks. With common infrastructure tasks disappearing with RISE with SAP S/4HANA Cloud, SAP Basis can evolve into managing the security and compliance risks of SAP cloud solutions. ... View more

The resilient survive, not necessarily the strongest. The resilient know how to withstand and recover from adverse situations, or even thrive during rapid change. When business, technology, cyber and physical resilience align and interact – as they must, to be truly resilient – we start to see overlaps. It is in these intersections that we find opportunity. But these are also where gaps will appear if they are not managed well and that could make the organization vulnerable. ... View more

Safeguarding Success: Navigating SAP Governance & Security with SAP IAG, Process Control & BIS   Introduction: This blog is dedicated to the intricate world of governance, security, and controls within SAP environments. Delve into the realm where SAP Identity Access Governance (IAG), process control, and SAP Business Integrity Screening converge to fortify organizational integrity. Join us as we explore the critical intersection of technology and governance, ensuring compliance, risk mitigation, and operational excellence. Uncover insights, strategies, and best practices to navigate the complexities of SAP systems with precision and confidence. SAP Cloud Identity Access Governance (IAG) SAP Cloud Identity Access Governance (IAG) will enable organizations to achieve robust access control and governance across on-premises and cloud applications. Built on SAP Business Technology Platform (BTP) and SAP's proprietary HANA database, IAG integrates seamlessly with SAP Identity Authentication Service (IAS) and Identity Provisioning Service (IPS), offering a multi-tenant environment. The various facets of SAP Cloud IAG in scope are depicted below.   Scope: Services: The below services have been considered in-scope are: Access Request Service: A self-service access request form for user and role provisioning into cloud applications and the S/4Hana application. This will include workflow-driven access provisioning mechanisms, empowering users while maintaining control.  The access request service will be configured to utilize workflow management, provisioning, and business logic. SAP Cloud IAG provides compliant provisioning of user access to the SAP applications mentioned in scope.     Role Design Service: Design of roles with a bottom-up approach, refining and defining roles. Machine learning (ML) algorithms to optimize access roles will also be used. Risk metrics will be defined, and usage trends within a business role will be used to evaluate the impact it has on end-users (so that role adjustments can be made).         Access Certification Service: Audits and certification of roles assigned across multiple cloud solutions to ensure compliance with security policies and refine access as needed.  review user access, roles, risks, and mitigation controls, and periodic user access reviews (UAR) and campaigns.   Access Analysis Service: Analysis of access risks across applications and refinement or remediation of access to meet audit requirements, including SAP S/4HANA, SAP Fiori, SAP cloud solutions, SAP Ariba, and SAP Fieldglass. Continuous access analysis uses real-time insights to support access compliance management.       Privileged Access Management Service: Setup to monitor access to sensitive and critical transactions by users with elevated authorizations. Provision of super-user access, log consolidation, and review of logs with monitoring, reporting, and auditing.     SAP Process Control SAP Process Control, delivered as an add-on to SAP NetWeaver AS for ABAP 7.52, will enable to Document their control environments Test and assess controls Track issues for remediation Certify and report on the state and quality of process controls Manage policies Perform continuous monitoring of controls using a combination of data forms, automated workflows, certification, and interactive reports     The 2 facets of process control include: Compliance Management: Manage and monitor their internal control environment to proactively remediate any identified issues, and then certify and report on the overall state of the corresponding compliance activities.   Policy Management: Manage the overall policy lifecycle, including the distribution and attestation of policies by target groups.       SAP Business Integrity Screening SAP Business Integrity Screening is being proposed for detecting, investigating, and analysing irregularities in data, as well as preventing fraud.   The steps to be performed during implementation include Design: Determine Screening Lists Analyze patterns Define detection rules and models Setup: Define detection strategies based on fine granular criteria Define screening strategies for business partners Use real time simulations and calibration of strategies  Detect: Execute mass and real-time detection runs Stop anomalies or irregular transactions Investigate: Manage alert workload with evaluation & qualification Remediation of issues   Analyze: Monitor key performance indicators Management reporting   By virtue of being on S/4 HANA, BIS handles large volumes of payments, processing through real-time simulations. SAP BIS also integrates with different process areas like master data management, invoice processing, payment execution (payment runs), BIS has a highly flexible detection and screening strategy for business partners where new rules can be added and it can make composite rule scenarios, resulting in an overall risk score being awarded. For example, a weighted score may be determined based on individual Rules like: Payment value banding. Consecutive payments to the same beneficiary. Beneficiary address in an ‘at-risk’ country.     Architecture               ... View more

On March 7th, the US National Security Agency (NSA) published 10 strategies for securing cloud landscapes. These 10 strategies are an important contribution to cloud security, especially since the recommendations are agnostic of cloud platform and cover Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) cloud services. SAP regularly collaborates with NSA and CISA though the Enduring Security Framework (ESF) and Joint Cyber Defense Collaborative (JCDC) public – private partnerships and applauds their leadership role with this announcement. ... View more

​In this age of swift technological progression and changing regulatory landscape, businesses are progressively capitalizing on data, artificial intelligence (AI), machine learning (ML), and cloud technologies. This digital transformation is an arena that presents prospects not solely for optimizing operations but also for fostering trust among its stakeholders. In this article, we delve into how SAP is pioneering digital trust through transparency, reinforcing ethical practices, boosting data privacy, and hardening security. SAP's approach emphasizes value-driven goals, operational performance, and risk reduction, aligning with the broader journey towards digital transformation and long-term stakeholder trust. ... View more

Hi everyone! Despite a lot of companies are still using on-premise applications like SAP Logon (a.k.a. SAP GUI), the truth is that, eventually, everything will be managed in the cloud. This is a good thing: simplification, effectiveness, more capabilities, and every other benefit that the cloud offers. However, I've been meditating on whether back-end security will dramatically change as we know it (not to say, disappear). With the new capabilities of cloud-based Fiori and HANA, the need for SAP Logon is less relevant, and with it the need of things like role management in PFCG, users in SU01, traces, and so on. What do you think? Shall we, Security experts, be prepared for a radical change on the way we do things? ... View more

Discover how SAP secures over 6,000 AWS accounts with automated scanning and alerting. Learn how our "Secure by Default" approach, leveraging cloud security tools, enhances security posture, scalability, and automation, ensuring comprehensive protection. We hope that this article will inspire you to take a look at your own security architecture.  ... View more

With cybersecurity threats and regulations rising, business leaders are increasingly aware of the criticality of security and compliance to business operations. Nevertheless, both cybersecurity- and ERP security leaders say they struggle to get support. In this article I discuss the dynamic between these leaders and how cloud transformation provides an opportunity towards better collaboration and security outcomes. ... View more

Cyber security research reports are great sources to understand adversary techniques and threats we need to defend against. The three reports discussed in this article do exactly that. Many of those threats can be defended through relatively simple and low cost controls with great impact. In this article, learn what we face in cloud security in 2024, and effective measures to defend against many of them. ... View more