Speed up development of framework and application authorization concepts for SAP ERP and S/4HANA

SAST Blog: Speed Up Development of Framework and Application Authorization Concepts for SAP ERP and S/4HANACompanies that use SAP are required to describe controls and procedures in documents that reflect the current status of the system and the general compliance guidelines. The concepts for framework and application authorizations are essential elements of this documentation, for both internal requirements and annual reviews by external auditors. Good documentation templates can help get you where you need to go much more quickly.

Continue reading

How to define the right defaults for a framework authorization structure of your SAP HANA database

SAST BLOG: Framework authorization structure for the SAP HANA database – defining the right defaults SAP HANA is based on an in-memory technology concept for data storage. This makes it possible to analyze large, non-aggregated datasets flexibly with extremely short processing times. Since data processing in SAP HANA differs significantly from that in SAP NetWeaver, it has its own user management and authorization system. But which default settings are needed for the SAP HANA authorizations?

Continue reading

Configuring and assigning SAP authorizations in SAP Fiori apps

SAST Blog: Configuring and Assigning SAP Authorizations in SAP Fiori AppsFor a number of years now, SAP has been pursuing a new strategy for how SAP users interact with its software. Complex SAP applications are being subdivided into role-based SAP Fiori apps, with the aim improving user friendliness while also enhancing the user experience. A rising number of companies are considering implementation of SAP Fiori apps and are now faced with determining which authorizations must be allocated to their employees for access to the app.

Continue reading

Study shows SAP systems especially prone to insider attacks

SAST BLOG: Study shows SAP systems especially prone to insider attacksAfter many years working in the field of SAP security, I am still regularly surprised to discover how much Hollywood has contributed to the discussion on cybersecurity. The common perception is that of a hacker sitting at home in front of several screens and using cryptic commands to hack into corporate networks. The recently published “Insider Threat 2018 Report” however, shows that insider attacks represent a much more serious threat. As far as the security of SAP systems is concerned, insider attacks are by far the greater problem. Why that is the case and what the main risks are is the subject of this post. Continue reading