What’s Happening in Information Risk Management

What’s Happening in Information Risk
Management

2CUSTOMER© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
What’s Happening with Information Risk Management
Overview of SAP Dynamic Authorization Management
Why SAP Dynamic Authorization Management
Summary
Agenda

How to effectively secure data and applications
Governance
and compliance
 Global business model
 External partners
 Distributed supply chain
Collaboration
 Secure sensitive data
 Defend against cyberattacks
 Make better and faster decisions
Competitiveness
 Prevent violations
 Financial management
 Health and privacy
Agility
and efficiency
Need to share Need to protect
 Accelerate time to market
 Streamline business processes
 Leverage cloud and mobility
“How do I protect sensitive information and still share with my extended enterprise?”

 Enhancing security of SAP applications
 Protecting sensitive data throughout the
enterprise
 Preventing policy violations, including fraud,
compliance, security
 Increasing data security without increasing
number of roles to an unmanageable level
 Eliminating manual tasks to automate processes
and facilitate business goals
Customer challenges

The expanding approach to access control
(Role-based access
control)
(Attribute-based access control)
ABAC
RBAC
Groups
+
Access
control
lists
Administrative
Grant permission prior to access
attempt
Systemic
Access determined by software
Runtime
Grant permission at time of
access attempt
Procedural
Access determined by people

Attribute-based access control enhances the scalability of roles
Gartner predicts attribute will be
new role.1
Kuppinger recommends
dynamic authorization.2
Attributes are now “how
we role”
Prediction:
By 2020, 70% of all
businesses will use attribute-
based access control (ABAC)
as the dominant mechanism
to protect critical assets, up
from <5% today.
NIST highlights ABAC.
1: Gartner Predicts 2014: Identity and Access Management 2: Kuppinger Cole Leadership Compass for Access Governance 3: NIST: Guide to Attribute Based Access Control (ABAC) Definition and Considerations
Dynamic
authorization
management
Privileged
access/user
management
Provisioning
integration
Access
governance

Overview of SAP Dynamic Authorization
Management

SAP Dynamic Authorization Management application by NextLabs
Enhancing security for data and business applications
Gain insight
Monitor data and application
activity and streamline
business processes
Automate controls
Use single policy platform to
centralize and automate
data and application security
Prevent violations
Minimize fraud; prevent
compliance and security
violations
Secure access
Use consistent and on-the-
fly access enforcement with
dynamic authorization
Access
governance

Automate controls
SAP Dynamic Authorization Management
Automated enforcement of data and application security controls
 Incorporates an attribute-based access control model with fine-grained
contextual information
 Automates data classification and segregation
 Provides ability to control access at the transaction or field level

Fine-grained authorization
 Access controls at
– Transaction level
– View level
– Field level
 Automated data classification
– Ensures that sensitive data is categorized
properly
– Enables accurate policy enforcement
 Policy management
– Business level policy authoring tool
– SAP GRC integration
– Central management
ABAC enhances traditional access control
ACCESS DENIED: Only members of
Project Y can access project data

Features
 Classification of structured and unstructured data
in SAP software
 User-driven classification of data
 Classification based on content and/or association
 Automatic policy-based classification
 Classification that can be triggered at run time or
through batch processes
Automates data classification

Secure access
Enforce policy decisions consistently and on-the-fly
 Real-time policy messages with explanation and corrective workflow
 Integration with existing identity management, HR, and directory systems
 Centralized policy management, ensuring consistent application across
geographies and divisions

 Integrates with identity and attribute sources
 Designs, deploys, and evaluates policies
 Centrally manages policies
 Allows drag-and-drop authoring
 Uses business-friendly nomenclature
 Provides reusable policy components
Control center – policy engine

 Fine-grained access control takes into account
contextual factors
 Attributes are categorized into subject,
environment, and resource
 Attributes can be changed easily and can be
applied dynamically
Incorporates attribute-based access control

Who is using or sharing what data? How, why, and with whom?
Integrating identity, content, and context attributes
 User
 Recipient
 Internal and external
 Data type
 Metadata
 Custom tags
 Data content
 Computer
 Network location
 Channel/application
 Connection
 Time
Identity
ContentContext

Business-level policies
Who can access what, when, and where
Allow
Users
View, edit
“Secret”,
“top secret”
documents
User
clearance
Document
sensitivity
User
citizenship
U.S.
Auth. type
‘Multifactor’
is greater than
or equal to
is equal to is equal to
ANDANDIF
TO
Allow U.S. citizens only
To view and edit
Secret and top secret documents
If the user’s security clearance
is higher than or equal to the sensitivity classification of the document
And authentication scheme is multifactor
User/subject
attribute
User/subject
attribute
Environment
attribute
Resource
attribute

 Policies are evaluated dynamically during access
request.
 Policies use detailed attributes to more accurately
determine what content should be accessed –
what, why, when, and where.
 Changes in attributes and policies are seamless to
the end user.
Policies use attributes during transaction for real-time authorization.

Prevent violations
Prevent fraud, compliance, and security violations
 Automatically incorporates business rules and policies and applies them from a
central system
 Real-time contextual information prevents users from accessing unauthorized
information
 Integrates with SAP Access Control segregation of duties (SoD) rule set to
prevent violations

 Rules and policies applied at time of update to
ensure that the latest information is taken into
account before allowing access
 Central repository for authoring and applying
business rules and policies to ensure changes are
up-to-date and consistent – minimizes manual
intervention
Automatically incorporates business rules and policies for continuous
governance

Applies authorization policies from a central system
 Organizations can update and enforce corporate policies across the extended enterprise
 This is easier to implement and maintain
Policy studio
Reporter
Administrator
Control
center
Policy
server
CUA/LDAP/HRMS/
active directory
Switch
Policy
controller
SAP SCM
Doc. mgt. system
SAP PLM
SAP ERP
SAP GUI
Mobile
Web GUI

Prevents role explosion
 Functional roles cover broad static functions
 Derived roles enable the next level of organizational
detail for transactions
 A new role needs to be created for every new
transaction capability
United States
employee
Canada
employee
UK
employee
Germany
employee
Netherlands
employee
Sweden
employee
Finland
employee
Sweden
employee
North America employee EU employee
Employee
Resulting in:
 Exponential increase of derived roles

Integrates with SAP Access Control
 Combine SAP roles and access control information with attributes for dynamic authorization
decisions incorporating location, HR info, computer, organization, time, and so on.
 Attributes can now be pulled automatically using the attribute adapter provided as part SAP
Access Control 10.1
Entitlement Manager
Data c
classification
Data segregation Access control Audit
Control Center
Information control policies
SAP ERP
User attributes
SAP Access Control
User attributes
Source
of attributes
AD/LDAP CUA HR

Stops segregation of duties (SoD) violations before they occur
 Activating SoD checks through configuration
 Integrating with GRC access control SoD rule set
 Stopping or warning the user during transaction
Resulting in
 Reduction in SoD violations
 Reduction in effort and resources to mitigate SoD violations and
enforce compliance
Enhances SAP Access Control by preventing
SoD violations
You ran the reports and have 2,345,678 violations.
Now what?

Gain insight
Monitor data and application activity and streamline business processes
 Removal of barriers to improve efficiency
 Centralized reporting and audit to detect patterns and anomalies
 Dashboards, trend analysis, and incident investigation for preventive action

 All the activity is logged and reported
across multiple applications
 It tracks access across SAP applications
 The centralized activity journal has
customizable reporting and compliance
dashboards
 The alert system tracks abnormal activity
and signals when it reaches threshold limit
Centralized reporting on information usage and compliance

Key features for attribute-based access control
 Incorporates an
attribute-based access
control model with fine-
grained contextual
information
 Automates data
classification and
segregation
 Provides ability to
control access at the
transaction or field
level
 Real-time policy
messages with
explanation and
corrective workflow
 Integration with
existing identity
management, HR, and
directory systems
 Centralized policy
management, ensuring
consistent application
across geographies
and divisions
 Automatically
incorporates business
rules and policies and
applies them from a
central system
 Real-time contextual
information prevents
users from accessing
unauthorized
information
 Integrates with SAP
Access Control SoD
rule set to prevent
violations
 Removal of barriers to
improve efficiency
 Centralized reporting
and audit to detect
patterns and
anomalies
 Dashboards, trend
analysis, and incident
investigation for
preventive action
Automate controls Secure access Prevent violations Gain insight

Why

Benefits and capabilities
Benefits
Strengthens security for sensitive
information to enable safe collaboration
and regulatory compliance
Reduces information management risk
Centralized policy management ensures
consistent application across geographies
and divisions
Simplified access administration greatly
reduces the number of user roles under
management
Capabilities
Attribute-based access control model
with fine-grained contextual information
Real-time policy messages with
explanation and corrective workflow
Integration with existing identity
management, HR, and directory
systems
Centralized reporting and audit to detect
patterns and anomalies

Why SAP GRC solutions
SafeIntegratedSimple
 Do more with less: reduce the cost
and effort of your GRC and
security programs
 Use a modular approach to deploy
at your own speed
 Gain an enterprise approach and
view into your GRC and security
activities and bring together
disparate parts of the organization
 Take advantage of native
integration for real-time exception
monitoring and decision making
 Get up and running faster,
leveraging industry and line-of-
business content
 Go lean with automated
monitoring on very large amounts
of data
 Reduce risk by choosing an
industry-recognized, leading GRC
and security portfolio
 Meet the requirements of your
organization by choosing how you
want to deploy ‒ in the cloud or
on premise
 Share and learn from a community
and partner ecosystem that is
second to none

Take a look at
www.sap.com/GRC
www.sap.com/security
www.sap.com/finance
Follow our blogs
GRC Tuesdays
Find detailed information
sap.com product page
Follow us on Twitter
#SAPGRC
For more information
Not Your
Father’s
Finance

Thank you.
Contact information:
Michael Gurican
NextLabs, Inc. | Enterprise Account Executive
414-234-0249 | michael.gurican@nextlabs.com

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company.
The information contained herein may be changed without prior notice. Some software products marketed by SAP SE and its distributors contain proprietary software components
of other software vendors. National product specifications may vary.
These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated
companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are
set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.
In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release
any functionality mentioned therein. This document, or any related presentation, and SAP SE’s or its affiliated companies’ strategy and possible future developments, products,
and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time for any reason without notice. The
information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various
risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements,
and they should not be relied upon in making purchasing decisions.
SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company)
in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies.
See http://global.sap.com/corporate-en/legal/copyright/index.epx for additional trademark information and notices.
© 2017 SAP SE or an SAP affiliate company. All rights reserved.

What’s Happening in Information Risk Management

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to What’s Happening in Information Risk Management

Similar to What’s Happening in Information Risk Management (20)

Recently uploaded

Recently uploaded (20)

What’s Happening in Information Risk Management