The authorization structures at many companies have grown organically. Over the course of time, users have often been granted wider authorization privileges than they actually need for their everyday work. As a result, data availability and integrity, as well as system availability, can be critically endangered. Authorization managers see an increasing need for action to minimize the risk of SAP security incidents. After all, many more IT incidents still remain unreported compared to published cases.
Get your SAP S/4HANA migration into high gear with a sound security strategy
Seize the opportunity to take your SAP S/4HANA migration to a new level with a cleanly designed, holistically planned security and compliance strategy. After all, having structured plans from the start will reduce the workload in the long term. That’s why you should ultimately see this challenge as an opportunity as well: to improve the security of your SAP systems, streamline your role concepts, and enable use of the new system with all its benefits.
Comprehensive SAP S/4HANA security strategy reduces additional downstream costs
Schott AG is considering its SAP S/4HANA transformation from all aspects, from code and processes, down to authorizations for its SAP S/4HANA migration.
In this interview, Thomas Frey (SAP Authorizations Consultant, SAST SOLUTIONS) explains the requirements you need to keep track of when rolling out SAP S/4HANA – and what you must avoid at all costs.
Takeda trusts in the SAST SUITE to reduce SoD conflicts in their heterogeneous SAP landscape
Takeda, Japan’s largest pharmaceuticals company, manages its business processes in a global, heterogeneous IT landscape. From SAP ERP to SAP Cloud applications, employees work at a variety of levels, depending on their involvement in processes, and therefore need access to a number of systems. As a result, the company has to constantly review conflicting authorizations to meet strict compliance requirements, such as segregation of duties (SoD). Most standard software solutions on the market only monitor SoD conflicts and risks in a single system, however, which led the company to search for an end-to-end solution.
Secure your SAP systems worldwide: Best practice recommendations for successful national and international rollouts with the SAST SUITE
Companies all over the world rely on SAP as their central enterprise software suite. That’s why it’s becoming ever more important for them to protect these SAP systems, along with the enterprise values they contain, with a professional cybersecurity and access governance strategy. Many international companies already trust the SAST SUITE to help them manage their international rollouts, and for good reason.
Why your SAP security and compliance strategy can’t wait for an SAP S/4HANA migration
Companies have been sensitized to the risks: According to a recent report by consulting firm Ernst & Young, 97 percent of the surveyed executives expect that they will face an even greater risk of cyberattacks and data leaks in the future. And they also know that they can hardly keep up with the rapid advances. That’s why we recommend that you give thought to end-to-end protection of your SAP systems now – no matter whether you’re still using SAP ERP or have already migrated to SAP S/4HANA. The sooner you start with an end-to-end strategy, the better you’ll protect yourself against threats – both internal and external.
Role adjustments for technical SAP users – how to handle authorizations safely and effectively
Technical SAP users that have extensive authorizations like SAP_ALL pose a heightened security risk. Vulnerabilities can endanger interfaces and paralyze processes. As such, external auditors are intensifying their focus on authorization management. One of our customers – a company in the energy sector – recently faced the challenge of having to restrict the authorizations of its technical users (batch processing/RFC interfaces).
Act immediately to remedy the Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management!
Information just now officially provided as part of the November SAP Patchday describes a new critical vulnerability: The SAP Security Note 2928635 (CVE-2020-6284) is a Cross-Site Scripting vulnerability (XSS) in SAP NetWeaver Knowledge Management. Act now to close the loophole!
Don’t lose track of the big picture – a security dashboard provides transparency for all your SAP systems
The lack of SAP security management dashboards is discussed often by the Security & Vulnerability Working Group at DSAG, the German-speaking SAP User Group. The Working Group sees such tools an essential prerequisite for developing and monitoring the improved security concepts that are urgently needed. Yet a majority of companies has yet to implement the dashboard technology although now would be a particularly good time to implement this efficient tool for mitigating attacks in light of the increasing threat level posed by malware and ransomware.
Follow the progress of your SAP authorization redesign project at all times – with the “Ticket Monitor” add-on to the SAST SUITE
One of our long-standing customers, the largest forklift manufacturer in Europe, uses the SAST SUITE for its SAP authorization management alongside a variety of IT services from akquinet AG. As part of a compliance project, the SAST Consulting team was commissioned to redesign and re-engineer all SAP authorizations for nearly 900 users in Germany. In this guest commentary from Sascha Heckmann, together with external SAP consultant Bernhard Radermacher, he tells how the “Ticket Monitor” a custom-developed add-on for the tried and tested SAST Safe Go-Live Management helped the project become a full success.