Streamlining Access Control for SAP Systems

Transcription

1 WHITE PAPER Streamlining Access Control for SAP Systems The Many Advantages of Automated User Provisioning For organizations with high-volumes of employees leveraging SAP solutions, managing access to these powerful systems is a complex undertaking. IT personnel are often plagued with constant requests streaming in over , by phone and through web-based forms. Given the myriad of duties assigned to each worker combined with an overload of user provisioning requests, many SAP solutions users are inadvertently granted access to systems that compromise controls, creating significant compliance issues. Add complex manual processes and a lack of workflow for contractors and the process becomes more complicated. To meet strict regulatory requirements, a laborious process of checks and balances must take place with the bulk of the effort falling squarely on the shoulders of the IT group and business managers. Inefficient management of access control ultimately hinders employee productivity. The wait for approvals and verifying access rights often means users are unable to utilize critical systems for days. Worse, inappropriate user access goes unchecked, exposing the organization to greater risks of fraud. How can IT eliminate access control conflicts? Is there an easy way to speed user provisioning, freeing IT personnel for other tasks? To meet these challenges, many large organizations are turning to automated user provisioning for SAP solutions. Designed to streamline access to SAP systems, these workflow solutions automatically provision users while enforcing segregation of duties (SoDs). This white paper will examine the access control challenges faced by IT and reveal the many advantages of automated user provisioning for SAP solutions. User Provisioning Trends IT will lean heavily on automated solutions to help streamline the user provisioning process When employees switch roles or leave the company, access privileges often remain unchanged. According to the META Group, more than one in three user accounts or access privileges remain active after an employee has left

2 Page 2 the organization. 1 This problem also applies to employees shifting positions within the organization. CIO magazine found that "most companies didn't have processes in place to make sure that when people switched divisions, their access to applications changed to reflect their new responsibilities." 2 A growing trend is IT's inability to quickly respond to access control issues. For example, CIOs overwhelmingly reported a reliance on manual controls when dealing with SoD issues, according to CIO magazine. 3 "Within a few years, technical mechanisms to enforce SoDs will be considered virtually mandatory for ERP instances within regulated companies," stated a Gartner report. 4 Another Gartner report declared, "Enterprises need to automate and manage application-level business policies and rules to identify SoD violations, quickly remove those violations and ensure new SoD violations are not introduced." 5 The Enterprise Management Association declared that automating IT workflow was one of the top IT management trends for Gartner predicts, "The demand for SoD functionality will grow through 2010 as organizations look to automate controls for efficiency and cost savings." 7 The User Provisioning Challenge Manually provisioning users places a major burden on IT and slows the process of approving access. IT Staff Overworked Provisioning Users Manually processing access requests is a timeconsuming process complicated by SoD analysis SAP systems are the lifeblood of many businesses. Whenever employees need access to business applications, security and access issues must be closely scrutinized. Regulations call for careful SoD assessments to ensure no employee can compromise financial or security policies. For example, an employee could be granted access to create purchase orders and approve invoices for payment. Clearly these two roles could allow the employee to embezzle funds from the organization. To ensure duties are segregated, IT has typically implemented basic access control procedures. User provisioning traditionally starts with an sent to IT, identifying the employee and the requested access. The problem with this manual approach is it lacks any traceable workflow. Until someone from IT responds, nothing happens. 1 Swoyer, S. (April 5, 2005). Enterprise Systems. Trends: Identity management and access management needed on mainframes, too. 2 Worthen, B. (July 1, 2005). CIO. The top five IT control weaknesses. 3 Ibid. 4 Proctor, P. E., et al. (February 9, 2007). Gartner. MarketScope for segregation of duties controls within ERP, Perkins, E. & Wity, R. J. (August 27, 2007). Gartner. Magic quadrant for user provisioning, 2H07. 6 (December 17, 2007). GRID Today. Virtualization, automation among trends to watch in Proctor, P. E., et al. (February 9, 2007). Gartner. MarketScope for segregation of duties controls within ERP, 2007.

3 Page 3 Often custom databases or Microsoft Excel spreadsheets are used to perform basic user provisioning request tracking. An IT administrator typically manually enters data into these home-grown systems. The requested roles then must be analyzed for SoD conflicts. In large organizations, the volume of requests combined with the sheer number of possible roles creates a very slow SoD analysis process. It is not uncommon for IT to have multiple individuals whose sole purpose is to provision SAP users. A large part of their job functions involve handling the SoD analysis process. A typical SAP application can have hundreds of roles that must be analyzed for each request to ensure no conflicts exist. Poor Workflow The many individuals involved with provisioning users slows the approval process Multiple individuals throughout the company are also involved with granting user provisioning access. For example, the employee's direct report, data stewards who can approve access to specific functions and of course IT. With the back and forth communication for each critical role, the result is a very time-consuming and manual process. For example, if an HR employee wanted to modify vendors, she would first request access. The person who owns the process would be notified. Back and forth communication would typically take place, with the data steward asking clarifying questions. Phone calls and s are the primary means of communication. When key personnel are unreachable, workflow can quickly break down. In some cases, IT may provide the employee temporary access to systems, creating policy violations. A number of challenges emerge from manual workflow, including: Slow approvals as individuals send messages back and forth Inadvertent access is granted when it should not have been No verification if new access creates an SoD violation Intentional or accidental policy violations Users who were granted access create changes that result in large problems for the company A brief examination of the history of user provisioning reveals further insight. Brief History of User Provisioning Over the last few decades, user provisioning has evolved from a manual process to a fully automated one The process of provisioning users to business applications, like SAP solutions, has evolved with technology. In the 1980s, paper service request forms were completed each time an employee needed to be added or removed from the system. This inefficient and error-prone approach was eventually replaced with requests by the mid-1990s. However, there still remained manual processes to transfer content from s into SAP solutions. In addition, the s lacked uniformity, often resulting in follow-up messages.

4 Page 4 In the late 1990s, web-based forms and Lotus Notes became popular. An online database typically stored user access requests. However, workflow was still manual as employees needed to move data into SAP solutions. Around 2000, custom applications were developed at the department level to help streamline provisioning. The workflow was rigid. If an SAP solution changed, the custom applications needed to be redesigned. Developing and supporting custom user provisioning solutions was costly and often required extra manpower. In 2004, the first automated solutions emerged for user provisioning. Very basic in their functionality, these solutions typically performed nightly batch operations and did not interface with identity management applications, such as LDAP or ActiveDirectory. In 2007, the next generation of automated user provisioning products emerged. Able to provision users in real time, interface with identity management applications and support multiple SAP applications, these solutions are directly addressing the needs of IT. The Solution: Automated User Provisioning for SAP Solutions Automated user provisioning for SAP instantly checks access requests for SoD violations and routes them to the appropriate parties for approvals Designed to eliminate IT access control burdens and automate key workflow processes, automated user provisioning for SAP solutions greatly streamlines the process. Automated user provisioning tools for SAP solutions provision or deprovision users, automate SoD checks, provide a robust reporting tool for auditors and can recertify existing users. Now requests can be instantly checked for SoD violations, routed and approved, greatly speeding employee access to key systems. As a web-based solution, these tools reside on any web server and interface directly with SAP systems. Built with customizable workflows, automated user provisioning for SAP solutions avoids a paper trail by automating key provisioning tasks. For example, an employee can visit a web browser and create a request for access. The solution checks to make sure the request is within compliance requirements and optionally performs a real-time SoD check. This ensures only acceptable requests reach the desk of managers. The employee's manager receives an with the access request. The manager can approve or deny the request. If the manager approves the request, the system will forward the request to the functional owner for a final approval. Once the request is approved, the system provides immediate access and notifies the employee by . At any point in the process, an on-the-spot SoD analysis can be performed. The system examines which systems an employee should have access to based on his or her job function. Some of the unique functions of automated user provisioning solutions for SAP solutions include:

5 Page 5 Self-service password resets: If a password has expired, these solutions automatically generate a new password without the need to contact IT. SoD violation mitigation: If a request creates an SoD conflict, the system can automatically assign the request to a specialist and track the results. Reporting: Each request is tracked, including its status, who approved it and any conflicts. Role recertification: All users are recertified at regular intervals to ensure each user only has access to systems necessary to perform his or her current job requirements. The Benefits of Automated User Provisioning for SAP Solutions Now IT is freed from time-consuming and laborious SoD verification checks Automated user provisioning for SAP solutions provides many benefits for IT, including: Eliminates the need for manual paperwork Ensures employees are only granted access to systems necessary to perform their jobs Enforces compliance and security policies by automating SoD checks and providing audit trails Speeds access to systems for new and existing employees by performing checks in real time Allows IT to focus on other support-related tasks Lowers administrative costs to provision users by automating key procedures Automates the deactivation of users when they leave the organization Enables multiple systems to be provisioned with a single request Improves the tracking of user access requests Integrates with SAP business systems Automates the recertification process, ensuring the business remains compliant Provides accountability by tracking who approves what requests

6 Page 6 Allows employees to begin the access request process with a simple online form Allows IT to enhance its departmental support by providing managers greater control Example: Provisioning a Sales Clerk Joseph in sales is able to request and be granted access to send product demos in less than one hour The following example describes how automated user provisioning works. Joseph in sales logs into a web-based interface using his standard network login. The system interfaces directly with existing identity management or LDAP systems to determine Joseph's role. If Joseph already has been provisioned within SAP solutions, all currently assigned access rights are revealed. In addition, the applications that Joseph is qualified to access based on his job function are also presented. Joseph is identified as a sales clerk and is currently authorized to create sales orders within SAP solutions. Joseph is presented a list of possible functions that are appropriate for a sales clerk. Joseph selects the ability to issue product demos and adds customer refunds. The system performs an immediate SoD analysis and determines that processing refunds falls outside the normal job functions of a sales clerk. Joseph still requests both capabilities to be added. An is sent to Joseph's boss with a link to the automated user provisioning system. His boss approves the ability to send product demos but denies the ability to issue refunds after the system warns Joseph's boss of the conflict. The system notifies Joseph that his request to issue refunds has been denied. The approved product demo capability request is forwarded to the product manager who issues the final stamp of approval. The automated user provisioning system immediately updates Joseph's access rights in SAP solutions. Joseph is notified of his approved request and can immediately access SAP solutions and begin entering demo requests. The entire time from Joseph's initial request to his granted access was less than one hour. What to Look for in an Automated User Provisioning Solution Seek a solution that can accommodate conflict mitigation and monitor the activity of mitigated users When seeking an automated user provisioning solution for SAP solutions, consider the following important requirements: Automated conflict reporting: Look for a solution that can identify SoD conflicts at all stages, from the initial request to the final approval. This helps ensure all employees comply with corporate standards. Mitigation assessment: Seek a provisioning solution that allows conflicting requests to be analyzed and approved by appropriate individuals. Monitors mitigated users: The ideal solution will monitor the activity of any mitigated users and alert the appropriate personnel of questionable activity.

7 Page 7 Open interface: Integration with third-party applications should be possible to allow for customized workflow. Accommodates multiple SAP instances: A single request should accommodate multiple provisioning requests for each individual, to streamline processes. Works in development, quality assurance and production environments: Look for a solution that can suppress violations in development and quality assurance stages. The SecurePro Advantage SecurePro is helping large SAP customers to automate the provisioning of all SAP users Designed to free IT personnel from user provisioning tasks and automate key workflow, SecurePro from Security Weaver is a leading user provisioning solution for SAP solutions. Designed to meet all of the requirements outlined in this paper, SecurePro is the ideal solution to eliminate SoD conflicts and ensure compliance. Major organizations, such as Siemens AG, AIG Retirement Services, Toyota, Hitachi, Millennium Chemical and the Imperial Irrigation District rely on Security Weaver solutions. Founded in 2004, Security Weaver is a provider of solutions with SAP Certified Integration with the SAP NetWeaver platform. Built to reside on top of SAP solutions, SecurePro (short for secure provisioning) ensures businesses remain compliant with corporate and industry security standards. Now IT can rest assured that only the proper access to SAP systems has been granted to employees. With SecurePro, IT can: Automate formerly manual user provisioning processes Provide accountability and traceability of all provisioned users Enable self-service functions, such as password changes and access requests Speed the time it takes to grant users access Start streamlining your user provisioning processes today! For a FREE risk assessment, visit or for more information securepro@securityweaver.com