Protecting Information Assets:

A SAP Customer’s Perspective

Gerald West
09/05/2019

1
Agenda

• Introduction – 5
• Controls Approach - 5
• Technology Shield - 10
• Human Shield - 5
• Security Roadmap - 5
• Questions - 5

2
Securing SAP - Controls Approach
Dimensions Initiatives

E Define and optimise processes, policies and

Define standards
N
People
A Engage Engage and Educate User Community

B
Simplify Make it Easy To Do The Right Thing
L
Process Identify and Manage Risks, Issues and
E Know Control Mechanisms
E
Implement and Maintain Effective Controls
X Control (including Functionality)
Technology
E
Establish Robust Assurance , Audit and
C Assure Testing Processes
U
Data Analyse Controls Environment and Detect
T Report Exceptions
E

3
Securing SAP – The Technology Shield
Prevent Detect Respond

C
Levers Methodology
O
N
Change Control Prepare N
E
N
T Analyse
User Access E
W
Resolve C
O Settings & Configuration T
R Sustain
I
K Programs & software
Embed O
N
S
LOG MANAGEMENT

4
Securing SAP – The Human Shield

Campaigns Content

Phishing Simulations Training courses

Major campaigns Educational videos
Mini campaigns Articles

Communities
Communication

Breaking news Advocates

Urgent instructions Practitioners
Phishing reporting End users (e.g. Yammer)

5
Security Roadmap
Themes
Business Process Improvement
Engagement
Security Technology
Cyber Risk Management
Assurance & Audit
Reporting & Monitoring
Education & Awareness
Data Protection
6
Protecting value
Optimise Business processes
Engage security stakeholders
Exploit Security technology
Manage Cyber risk
Leverage Audit & assurance
Drive smart Reporting & monitoring
Enhance Education & awareness
Manage Data protection
CSI – Clarity, Simplicity, Integrity
Summary/ Key Points

• Securing SAP touches on all 4 dimensions of People, Process,

Technology and Data

• Manage Change Control, User Access, Settings & Configuration and

Programs & Software as the levers of your Technology Shield

• Some of these measures can increasingly be bypassed through social

engineering e.g. phishing attacks

• Improve your phishing resistance, raise security awareness and

encourage user communication to strengthen your Human Shield

• Create a Security Roadmap that addresses both the Technology and

Human shields

7
 Questions?