SAP Product Road Map SAP Security Products

Transcription

1 SAP Product Road Map SAP Security Products Customer Road Map Revision: Template Revision: v5

2 Legal disclaimer The information in this presentation is confidential and proprietary to SAP and may not be disclosed without the permission of SAP. This presentation is not subject to your license agreement or any other service or subscription agreement with SAP. SAP has no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation and SAP's strategy and possible future developments, products and or platforms directions and functionality are all subject to change and may be changed by SAP at any time for any reason without notice. The information in this document is not a commitment, promise or legal obligation to deliver any material, code or functionality. This document is provided without a warranty of any kind, either express or implied, including but not limited to, the implied warranties of merchantability, fitness for a. This document is for informational purposes and may not be incorporated into a contract. SAP assumes no responsibility for errors or omissions in this document, except if such damages were caused by SAP s willful misconduct or gross negligence. All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions. Customer 3

3 Introduction to product road maps Purpose Product road maps are designed to support the product adoption planning activities of SAP customers. A product road map helps a customer match short term and long term goals with technology plans. A product road map describes how the feature / function capabilities in an SAP product or technology are planned to progress over time, in general: Recent innovations = changes in the current and recent released version(s) Planned innovations = changes planned in one or more upcoming development release Product direction = proposed themes for major product releases beyond the current development plan Product vision = areas in which the product would be evolved based on technological and industry trends Complementary resources (for On-Premise releases) For a more general description of the business problems / processes being solved and supported by SAP, refer to Solution Road maps. For more detailed technical information please refer to the Product Availability Matrix and product documentation. Customer 4

4 Table of contents Topic Overview Topic description Key trends and customer needs Road map overview and major product updates Topic Road Map Recent innovations Planned innovations Product direction Product vision Appendix Customer 5

5 Topic Overview Topic description Key trends and customer needs Road map overview and major product updates

6 SAP s modular suite SAP Fiori SAP Cloud Platform Integration SAP Cloud Applications BusinessObject Cloud & Digital Boardroom Customer Specific and 3 rd Party Applications Marketplace API Business Hub Business Services SAP S/4HANA SAP BW/4HANA Security Services Integration Services Mobile Services UX Services Collaboration Services Analytics Services SAP Cloud Platform Machine Learning Services IoT Services SAP HANA SAP HANA SAP HANA Vora S3 SWIFT Hadoop Customer 7

7 SAP s security products SAP s GRC and security portfolio SAP CLOUD PLATFORM Security and Threat Intelligence: SAP Enterprise Threat Detection SAP Identity Management SAP Single Sign-On SAP Cloud Platform Identity Authentication SAP Cloud Platform Identity Provisioning SAP NetWeaver AS, add-on for code vulnerability analysis SAP Fortify by HP GRC portfolio: SAP Access Control SAP Cloud Identity Access Governance, access analysis service SAP Process Control SAP Audit Management SAP Fraud Management SAP Risk Management SAP Identity Analytics SAP Business Partner Screening SAP Global Trade Services SAP Electronic Invoicing for Brazil Customer 8 GRC Solution Extensions: SAP Access Management violation by Greenlight SAP Regulation Management by Greenlight (cyber governance solution) SAP Dynamic Authorization Management by NextLabs SAP Technical Data Export Compliance application by NextLabs

8 SAP s security products In the SAP security portfolio SAP Cloud Applications Manage access, users and compliance in the cloud SAP Cloud Platform Identity Authentication SAP Cloud Platform Identity Provisioning SAP Cloud Identity Access Governance, access analysis service SAP S/4HANA SAP Business Suite SAP Single Sign-On Make it simple for users to do what they are allowed to do SAP Identity Management Know your users and what they can do SAP Access Control Ensure corporate compliance to regulatory requirements SAP Enterprise Threat Detection Counter possible threats and identify attacks Add-On for Code Vulnerability Analysis Find and correct vulnerabilities in customer code 3 rd Party Systems Platform Security Make sure that SAP solutions run securely SAP Cloud Platform SAP HANA SAP NetWeaver Application Server Customer 9

9 SAP s security products Product road map overview - key themes and capabilities Recent innovations 2017 Planned innovations 2018 Product direction 2019 Product vision Secure and simple access SAP Single Sign-On 3.0 SP1 SAP Identity Management 8.0 SP4 SAP Cloud Platform Identity Authentication New product release SAP Cloud Platform Identity Provisioning Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection 1.0 SP5 SAP NetWeaver Application Server, add-on for code vulnerability analysis (version 7.51) Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Identity, governance and administration suite Integration with cloud IAM services SAP Cloud Platform Identity Authentication X.509 authentication, APJ data center, integration with SAP Cloud Platform Identity Provisioning SAP Cloud Platform Identity Provisioning Additional connectors, workflow Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection for SAP cloud applications SAP NetWeaver AS, add-on for code vulnerability analysis: New checks, reporting, developer productivity Customer 10 Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Hybrid identity management Support for SAP S/4HANA SAP Cloud Platform Identity Authentication Enhanced two-factor and risk-based authentication Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection SAP integration SAP Enterprise Threat Detection on SAP Cloud Platform SAP NetWeaver AS, add-on for code vulnerability analysis New checks, workflow, quick fixes Secure and simple access Integration of SAP Single Sign-On with SAP Enterprise Threat Detection Integrated and hybrid deployed security suite for identity and access management to support customers IT landscape strategy More data centers globally Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection New service (SaaS): security analytics and forensics as a service for any customer data Managed services for security monitoring operations This is the current state of planning and may be changed by SAP at any time.

10 Topic Road Map Recent innovations Planned innovations Product direction Product vision

11 SAP s security products Product road map overview - key themes and capabilities Recent innovations 2017 Planned innovations 2018 Product direction 2019 Product vision Secure and simple access SAP Single Sign-On 3.0 SP1 SAP Identity Management 8.0 SP4 SAP Cloud Platform Identity Authentication New product release SAP Cloud Platform Identity Provisioning Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection 1.0 SP5 SAP NetWeaver Application Server, add-on for code vulnerability analysis (version 7.51) Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Identity, governance and administration suite Integration with cloud IAM services SAP Cloud Platform Identity Authentication X.509 authentication, APJ data center, integration with SAP Cloud Platform Identity Provisioning SAP Cloud Platform Identity Provisioning Additional connectors, workflow Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection for SAP cloud applications SAP NetWeaver AS, add-on for code vulnerability analysis: New checks, reporting, developer productivity Customer 12 Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Hybrid identity management Support for SAP S/4HANA SAP Cloud Platform Identity Authentication Enhanced two-factor and risk-based authentication Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection SAP integration SAP Enterprise Threat Detection on SAP Cloud Platform SAP NetWeaver AS, add-on for code vulnerability analysis New checks, workflow, quick fixes Secure and simple access Integration of SAP Single Sign-On with SAP Enterprise Threat Detection Integrated and hybrid deployed security suite for identity and access management to support customers IT landscape strategy More data centers globally Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection New service (SaaS): security analytics and forensics as a service for any customer data Managed services for security monitoring operations This is the current state of planning and may be changed by SAP at any time.

12 SAP s security products SAP Single Sign-On 3.0 Secure and simple access Recent innovations SAP Single Sign-On provides simple, secure access to IT applications for business users. It offers advanced security capabilities to protect your company data and business applications. Simple and secure access Single sign-on for native SAP clients and web applications Single sign-on for mobile devices Support for cloud and on-premise landscapes Secure data communication Encryption of data communication for SAP GUI Digital signatures FIPS certification of cryptographic functions Advanced security capabilities Two-factor and risk-based authentication Authentication with smart cards or RFID tokens Hardware security module support Simplified management of backend security capabilities Customer 13

13 SAP s security products SAP Single Sign-On 3.0 SP1 Recent innovations Recent innovations SAP s newest Single Sign-On release helps customers leverage certificates, eases administration and reduces TCO Integration Cloud and on-premise business processes Integration with existing enterprise PKI Enhanced certificate support for mobile devices TCO reduction Automated certificate lifecycle management for SAP NetWeaver AS ABAP Advanced security capabilities Additional cryptographic enhancements Network edge authentication support with SAP Web Dispatcher Customer 14

14 SAP s security products SAP Identity Management 8.0 One source of truth for your identity data Recent innovations SAP Identity Management keeps users data secure and consistent and supports customers by implementing integrated identity lifecycle scenarios with SAP s Cloud HR SuccessFactors or on-premise SAP HCM Integrate business processes Integrate with SAP HCM and SAP SuccessFactors to automate user access provisioning based on current business roles Ensure to build-in compliancy in the process by integration with SAP Access Control for segregation of duty conflicts Improve productivity Self-service for end-users password reset Self-service for end-users access request Improve security Reduce risk with centralized user identity management across SAP, non-sap solutions Revoke automatically access when person leaves company or in case of internal move Customer 15

15 SAP s security products SAP Identity Management 8.0 SP4 Recent innovations Recent innovations SAP s newest Identity Management release offers cloud enablement by integrating with SAP Cloud Platform Identity Authentication service and ease of implementation by new Rapid Deployment Solution Eclipse based development environment Harmonization of development infrastructure Graphical workflow designer Configuration packaging and authorization concept New SAP integration capabilities Full identity lifecycle covered with SAP SuccessFactors integration SAP HANA connector Available on SAP Adaptive Server Enterprise (ASE) database SAP Cloud Platform Identity Authentication service Rapid Deployment Solution package SAP Cloud Platform Identity Authentication Cloud On-premise SAP Identity Management Customer 16

16 SAP Cloud Platform Identity Authentication Authentication and single sign-on in the cloud Recent innovations SAP Cloud Platform Identity Authentication provides simple and secure access to web based applications with a variety of authentication methods anytime, from anywhere. The service was previously known as SAP Cloud Identity service. Secure and Simple Access Identity Federation based on SAML 2.0 Web single sign-on and desktop SSO Secure on-premise integration to reuse existing authentication systems Social and strong authentication Risk-based authentication User and Access Management User administration and integration with on-premise user stores User groups and application access management User self-services, e.g. password reset, registration, user profile System for Cross-domain Identity Management (SCIM) API Enterprise Features Branding of end user UIs Password and privacy policies Customer 17

17 SAP Cloud Platform Identity Authentication Q Recent innovations Recent innovations The latest release of SAP Cloud Platform Identity Authentication offers strong authentication through risk-based and two-factor authentication, on-premise integration to reuse existing identity infrastructure as well as enhanced enterprise features Authentication & single sign-on Identity federation (SAML) Social authentication and inbound federation Risk-based and two-factor authentication Kerberos/SPNEGO User and access management On-premise user store integration Custom password policies SCIM API Integration with SAP Identity Management Enterprise features Corporate branding of Uis and privacy policies Usage reporting US and EU data center ISO Customer 18

18 SAP Cloud Platform Identity Provisioning Identity lifecycle management in the cloud Recent innovations SAP Cloud Platform Identity Provisioning offers a comprehensive, low cost approach to identity lifecycle management in the cloud Solution overview Automatically create and manage user accounts Policy based authorizations management Re-using existing corporate user stores Optimized for SAP cloud applications and SCIM-enabled solutions Integrated with Identity Authentication and SAP Cloud Platform, integration service Integration option with SAP Identity Management Key value proposition Fast and efficient administration of user on-boarding Centralized end-to-end lifecycle management of corporate identities in the cloud Automated provisioning of existing on-premise identities to cloud applications SAP Cloud Customer 19

19 SAP Cloud Platform Identity Provisioning Q Recent innovations Recent innovations Easy on-boarding for your cloud applications covering a broad range of source and target systems, both in the cloud and on-premise Source Systems On-premise: SAP NetWeaver Application Server for ABAP Microsoft Active Directory Cloud: SAP SuccessFactors SAP Cloud Platform Identity Authentication Generic: SCIM-enabled solution LDAP Server SAP Cloud Target Systems SAP Cloud Platform SAP Cloud Platform Identity Authentication SAP Hybris Cloud for Customer SAP Jam Concur Google G Suite SCIM-enabled solution Cloud Foundry UAA Customer 20

20 SAP s security products SAP Enterprise Threat Detection Threat analysis and detection for business critical data Recent innovations SAP Enterprise Threat Detection provides insight into malicious activities throughout IT landscapes and enables companies to identify security breaches in real-time. The solution detects internal and external attacks based on security event information in combination with context data. Real-time security monitoring Gather events from a heterogeneous landscape including SAP and non-sap systems Evaluate pre-defined attack detection patterns by SAP and partners Develop and extend custom attack detection patterns matching your company s needs Raise alerts on suspected attacks and enable corresponding analysis and incident management Analyze events to derive profiles of normal behavior and identify deviation from these Visualize events to gain new insights, develop new patterns Gain an overview of the current threat situation Leverage SAP knowledge SAP delivers best practices to detect cyber attacks on SAP systems Out of the box integration with SAP systems Support for heterogeneous connectivity Manage big amounts of log data Leverage the SAP HANA platform to gather and process very large amounts of events Gain insight at unprecedented speed Customer 21

21 SAP s security products SAP Enterprise Threat Detection SP5 Recent innovations Recent innovations Collect event and context information SAP platforms NetWeaver ABAP/Java and HANA Large number of log adapters and automated log normalization Context enrichment (e.g. identity management) User pseudonyms Analyze and visualize events Enhanced forensic analysis capabilities Supervised machine learning and anomaly detection Pre-delivered and customer-specific attack patterns Continuous content delivery Monitor and act on incidents Variety of monitoring dashboards Real-time threat situation and alerting System security status Exploitation of SAP Security Notes Integration with SIEM and ticketing systems Operations Support for multiple-tier landscapes High availability setup Hot/warm data management Customer 22

22 SAP s security products SAP NetWeaver AS, add-on for CVA Minimize source code risks Recent innovations In order to break an application, a single flaw in any of its components/functions or the infrastructure may be enough. SAP NetWeaver Application Server (AS), add-on for code vulnerability analysis helps you to identify potential weaknesses in your application early in the development process to avoid this risk. Efficient scan technology Reduced false-positive rate by dataflow analysis Direct integration into the SAP system Improved developer experience Integral part of SAP development UIs Detailed help and explanations to all errors Assistance to find the right location for the fix Approval workflows for handling of false positives Integration Central monitoring and reporting in Solution Manager Integrated into SAP transport management tools Customer 23

23 SAP s security products: Platform services SAP Cloud Platform security services Recent innovations The SAP Cloud Platform security services provide delegated authentication and authorization services across applications Key capabilities Identity federation with SAML 2.0-based identity providers Flexible groups- and role-based authorization management Secure API protection with OAuth 2.0 Protection against common web attacks (XSS and XSRF) Secure end-to-end identity propagation to on-premise systems On-premise user directory integration via SCIM 1.1 (e.g. for user search) Full automation and integration of the service via platform APIs User Authentication Access protected resource Applications on SAP Cloud Platform Delegate Authentication Benefits Out-of-the-box identity federation without changing a single line of code Easy-to-use security mechanisms to protect and control application access in pure cloud and hybrid scenarios Identity provider (SAP Cloud Platform services: identity provisioning service, identity authentication service, single sign-on, 3 rd -party identity provider) Customer 24

24 Platform services SAP Cloud Platform security services Recent innovations Recent innovations The SAP Cloud Platform security services provide delegated authentication and authorization services across applications. Recent innovations include: Security compliance SOC 1 Type I and II SOC 2 Type I and II Secure development Additional OAuth 2.0 Authorization Grant Flows (SAML2 Bearer Assertion) Principal Propagation from Java/HTML5 to HANA XS with AppToAppSSO Default trust with SAP ID Service can be enhanced with additional SAML Identity Providers Added Groups Management to Authorization Platform API Customer 25

25 SAP s security products Product road map overview - key themes and capabilities Recent innovations 2017 Planned innovations 2018 Product direction 2019 Product vision Secure and simple access SAP Single Sign-On 3.0 SP1 SAP Identity Management 8.0 SP4 SAP Cloud Platform Identity Authentication New product release SAP Cloud Platform Identity Provisioning Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection 1.0 SP5 SAP NetWeaver Application Server, add-on for code vulnerability analysis (version 7.51) Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Identity, governance and administration suite Integration with cloud IAM services SAP Cloud Platform Identity Authentication X.509 authentication, APJ data center, integration with SAP Cloud Platform Identity Provisioning SAP Cloud Platform Identity Provisioning Additional connectors, workflow Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection for SAP cloud applications SAP NetWeaver AS, add-on for code vulnerability analysis: New checks, reporting, developer productivity Customer 26 Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Hybrid identity management Support for SAP S/4HANA SAP Cloud Platform Identity Authentication Enhanced two-factor and risk-based authentication Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection SAP integration SAP Enterprise Threat Detection on SAP Cloud Platform SAP NetWeaver AS, add-on for code vulnerability analysis New checks, workflow, quick fixes Secure and simple access Integration of SAP Single Sign-On with SAP Enterprise Threat Detection Integrated and hybrid deployed security suite for identity and access management to support customers IT landscape strategy More data centers globally Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection New service (SaaS): security analytics and forensics as a service for any customer data Managed services for security monitoring operations This is the current state of planning and may be changed by SAP at any time.

26 SAP Single Sign-On 2017 Planned innovations Reduction of administration and increased security Planned Innovations Certificate lifecycle management for AS Java Certificate lifecycle management helps manage the renewal of certificates, reduces manual efforts, and prevents downtime Trigger enrollment jobs with SAP NetWeaver scheduler Modern, UI5 based administration user interfaces Additional cryptographic capabilities Support for additional elliptic curves Digital signatures for UI5 based applications Generate standard SAP NetWeaver signature format from JavaScript Initial version based on ActiveX control in Internet Explorer Secure Login Client on macos JavaScript Web Client support Support for system policies Customer 27 This is the current state of planning and may be changed by SAP at any time.

27 SAP Identity Management 2017 Planned innovations Identity, governance and administration suite & integration with cloud IAM services Planned innovations Identity, governance and administration Enhanced integration with SAP GRC solutions to deliver an identity, governance and administration suite Integration Hybrid deployment model: SAP cloud services for identity and access management as extension for SAP Identity Management SAP HANA connector enhancements SAP SuccessFactors connector enhancements Connector Development Kit 2.0 User interface Extensions to the REST API Enterprise readiness Further enhancing ease of operations SAP cloud IAM services Other cloud apps Cloud On-premise SAP Identity Management Customer 28 This is the current state of planning and may be changed by SAP at any time.

28 SAP Cloud Platform Identity Authentication 2017 Planned innovations Planned innovations Authentication & single sign-on OpenID Connect support Two-factor authentication with SMS X.509 authentication OAuth protection of APIs Security token service User and access management Custom user attributes Integration with SAP Cloud Platform Identity Provisioning User profile page customization Enterprise features APJ data center EU disaster recovery data center Troubleshooting and audit logs Privacy policies version management IdP discovery component Custom mail service SAP Cloud Platform Customer 29 This is the current state of planning and may be changed by SAP at any time.

29 SAP Cloud Platform Identity Provisioning 2017 Planned innovations Planned innovations Additional connectors SAP Ariba Microsoft Office 365 SAP Fieldglass SAP BusinessObjects Cloud Provisioning SCIM based API for controlling the provisioning process from external applications Manage Identity Provisioning service execution from SAP Identity Management Workflow and notification services Integration with SAP Cloud Identity Access Governance, access analysis Automated access refinement based on segregation-of-duty analysis Extended reporting capabilities SAP Cloud Platform Identity Provisioning SAP Identity Management Cloud On-premise Customer 30 This is the current state of planning and may be changed by SAP at any time.

30 SAP Enterprise Threat Detection 2017 Planned innovations Planned Innovations SAP Enterprise Threat Detection for SAP cloud applications Monitoring of applications running on SAP Cloud Platform Deliver SAP cloud security best practices for on-premise EU GDPR compliance Operational effectiveness Query definition Updated patterns by SAP Graphical exploration of kill chains Improve forensic lab Optimize alert handling Resilient log data collection Push/pull support Scale up support Guaranteed delivery Distributed architecture support Reporting Security reports Management dashboards Integration Integration with partner solutions Configuration checks Customer 31 This is the current state of planning and may be changed by SAP at any time.

31 SAP NetWeaver AS, add-on for CVA 2017 Planned innovations New checks, reporting and developer productivity Planned Innovations New checks and reporting capabilities as well as full integration with development tools in Eclipse will significantly enhance the usability and the results of CVA and help customers find security vulnerabilities faster New checks Potential abuse of URL redirect SQL Script scanning (AMDP) Detection of direct access to sensitive DB tables Flexibility & performance Ability to check modifications to SAP programs Improved data flow analysis Reporting Public API to allow customer to create own reports Landscape Central Security Scan support including Exemptions, Transport, Trigger remote scan locally Developer productivity Full integration with ABAP development tools in Eclipse Customer 32 This is the current state of planning and may be changed by SAP at any time.

32 SAP Cloud Platform security services 2017 Planned innovations Planned Innovations The SAP Cloud Platform security services provide delegated authentication and authorization services across applications Secure configuration Customizable CP Roles for account members Redesign of security configuration UIs in the Cloud Cockpit Secure access Two-Factor-Authentication (2FA) for CP Administration (Cockpit, Console Client, Eclipse) Configuration of SAP Cloud Platform Identity Authentication tenants for BASIC Authentication Secure development Additional Platform APIs for security management (Trust Management, OAuth Client Management) Security compliance Additional attestations User Authentication Access protected resource Identity provider (SAP Cloud Platform services: identity provisioning service, identity authentication service, single sign-on, 3 rd -party identity provider) Applications on SAP Cloud Platform Delegate Authentication Customer 33 This is the current state of planning and may be changed by SAP at any time.

33 SAP Cloud Platform security services 2017 Planned innovations Customizable CP Roles for account members Planned innovations Customizable CP Roles offer more flexibility to adjust CP administration permissions to organizational requirements Customizable CP Roles are managed on global account level Sets of platform-provided permissions can be assigned Customer 34 This is the current state of planning and may be changed by SAP at any time.

34 SAP Cloud Platform security services 2017 Planned innovations Configurable Identity Provider for CP administration Planned innovations Customer can use their own SAP CP Identity Authentication tenant for managing CP administrators and developers instead of using SAP ID Service This enables customers to use advanced security features, such as Username, Password OTP: SAP CP Identity Authentication Username, Password + One-Time-Passcode SAP Cloud Platform Cockpit Eclipse Tools Configurable password policy Strong Two-Factor-Authentication (2FA) Account Administrator, Developer,.., User provisioning to SAP CP Identity Authentication is possible SAP Cloud Platform Console Client Customer 35 This is the current state of planning and may be changed by SAP at any time.

35 SAP s security products Product road map overview - key themes and capabilities Recent innovations 2017 Planned innovations 2018 Product direction 2019 Product vision Secure and simple access SAP Single Sign-On 3.0 SP1 SAP Identity Management 8.0 SP4 SAP Cloud Platform Identity Authentication New product release SAP Cloud Platform Identity Provisioning Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection 1.0 SP5 SAP NetWeaver Application Server, add-on for code vulnerability analysis (version 7.51) Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Identity, governance and administration suite Integration with cloud IAM services SAP Cloud Platform Identity Authentication X.509 authentication, APJ data center, integration with SAP Cloud Platform Identity Provisioning SAP Cloud Platform Identity Provisioning Additional connectors, workflow Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection for SAP cloud applications SAP NetWeaver AS, add-on for code vulnerability analysis: New checks, reporting, developer productivity Customer 36 Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Hybrid identity management Support for SAP S/4HANA SAP Cloud Platform Identity Authentication Enhanced two-factor and risk-based authentication Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection SAP integration SAP Enterprise Threat Detection on SAP Cloud Platform SAP NetWeaver AS, add-on for code vulnerability analysis New checks, workflow, quick fixes Secure and simple access Integration of SAP Single Sign-On with SAP Enterprise Threat Detection Integrated and hybrid deployed security suite for identity and access management to support customers IT landscape strategy More data centers globally Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection New service (SaaS): security analytics and forensics as a service for any customer data Managed services for security monitoring operations This is the current state of planning and may be changed by SAP at any time.

36 SAP s security products SAP Single Sign-On 2018 Product direction Product direction Certificate lifecycle management Add support for SAP HANA Additional cryptographic capabilities Support for additional elliptic curves Digital signatures for UI5 based applications Add support for other Windows and macos based browsers by using JavaScript Web Client Hardware security modules Additional scenarios covered with hardware security modules Customer 37 This is the current state of planning and may be changed by SAP at any time.

37 SAP s security products SAP Identity Management 2018 Product direction Product direction Hybrid identity management SAP Cloud Platform Identity lifecycle across on-premise and cloud Extend integration with SAP Cloud Platform services for identity and access management Identity Authentication service Identity Provisioning service Access Analysis service Integration SAP S/4HANA, SAP Ariba, SAP Travel Management Solutions (a.k.a. Concur), SAP Hybris, SAP Hybris Cloud for Customer Reporting enhancements Customer 38 This is the current state of planning and may be changed by SAP at any time.

38 SAP Cloud Platform Identity Authentication 2018 Product direction Product direction Authentication & single sign-on Mobile native scenarios Two-factor authentication with and RADIUS protocol Reusable risk-based authentication policies API based authentication flow Custom extension framework User and access management Delegated administration (B2B) Approval for self-registration and implicit user group assignment Enterprise features Extended data center coverage Advanced reporting and monitoring Customer 39 This is the current state of planning and may be changed by SAP at any time.

39 SAP s security products SAP Enterprise Threat Detection 2018 Product direction Product direction SAP integration System context data via SAP Solution Manager Incident management integration Emergency Access Management integration Access control verification on runtime level SAP Enterprise Threat Detection on SAP Cloud Platform On-premise log collector Web UIs for security monitoring, IT forensic and security incident management Combine security events from cloud and on-premise systems Managed security services Customer 40 This is the current state of planning and may be changed by SAP at any time.

40 SAP s security products SAP NetWeaver AS, add-on for CVA 2018 Product direction Product direction New checks New checks based on state of the art research and forensics Workflow Option to replace built-in workflow by other workflow engine Developer productivity Quick fixes for automated code adjustments Customer 41 This is the current state of planning and may be changed by SAP at any time.

41 SAP s security products Product road map overview - key themes and capabilities Recent innovations 2017 Planned innovations 2018 Product direction 2019 Product vision Secure and simple access SAP Single Sign-On 3.0 SP1 SAP Identity Management 8.0 SP4 SAP Cloud Platform Identity Authentication New product release SAP Cloud Platform Identity Provisioning Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection 1.0 SP5 SAP NetWeaver Application Server, add-on for code vulnerability analysis (version 7.51) Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Identity, governance and administration suite Integration with cloud IAM services SAP Cloud Platform Identity Authentication X.509 authentication, APJ data center, integration with SAP Cloud Platform Identity Provisioning SAP Cloud Platform Identity Provisioning Additional connectors, workflow Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection for SAP cloud applications SAP NetWeaver AS, add-on for code vulnerability analysis: New checks, reporting, developer productivity Customer 42 Secure and simple access SAP Single Sign-On Increased security and further reduction of administration SAP Identity Management Hybrid identity management Support for SAP S/4HANA SAP Cloud Platform Identity Authentication Enhanced two-factor and risk-based authentication Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection SAP integration SAP Enterprise Threat Detection on SAP Cloud Platform SAP NetWeaver AS, add-on for code vulnerability analysis New checks, workflow, quick fixes Secure and simple access Integration of SAP Single Sign-On with SAP Enterprise Threat Detection Integrated and hybrid deployed security suite for identity and access management to support customers IT landscape strategy More data centers globally Threat intelligence and security vulnerabilities SAP Enterprise Threat Detection New service (SaaS): security analytics and forensics as a service for any customer data Managed services for security monitoring operations This is the current state of planning and may be changed by SAP at any time.

42 SAP s security products SAP Single Sign-On 2019 Product vision Product vision We plan to extend SAP Single Sign-On further following our basic principles: Security Provide state-of-the-art security capabilities supporting SAP s business applications Extend integration with SAP Enterprise Threat Detection, SAP Cloud Platform, mobile services, and partner products Productivity Offer service for provisioning of certificates on SAP Cloud Platform Digital signatures based on signature client Simplicity Tight integration with platform security Customer 43 This is the current state of planning and may be changed by SAP at any time.

43 SAP s security products SAP Identity Management 2019 Product vision Product vision We plan to extend SAP Identity Management further following our basic principles: Lower IT support costs Full support of identity lifecycle across on-premise and cloud Make it easy to install, operate and enable new integrations with additional SAP and non-sap solutions Create an integrated and hybrid deployed security suite Customer 44 This is the current state of planning and may be changed by SAP at any time.

44 SAP Cloud Platform Identity Authentication 2019 Product vision Product vision SAP Cloud Platform Identity Authentication is SAP s offering for authentication and single sign-on in the cloud SAP Cloud Platform Identity Authentication targets to be the central solution for authentication and single sign-on for all SAP cloud solutions. SAP plans to extend the solution to support more options for stronger authentication, additional protocols and multi-datacenter availability. Customer 45 This is the current state of planning and may be changed by SAP at any time.

45 SAP Cloud Platform Identity Provisioning 2019 Product vision Product vision SAP Cloud Platform Identity Provisioning is SAP s offering for managing identities and access in the cloud SAP Cloud Platform Identity Provisioning will not replace SAP Identity Management, but may optionally extend an existing on-premise identity lifecycle management towards the cloud Customer 46 This is the current state of planning and may be changed by SAP at any time.

46 SAP s security products SAP Enterprise Threat Detection 2019 Product vision Product vision We plan to extend SAP Enterprise Threat Detection further: New service (SaaS): security analytics and forensics as a service for any customer data Managed services for security monitoring operations Customer 47 This is the current state of planning and may be changed by SAP at any time.

47 Summary SAP offers a comprehensive portfolio of Security and GRC solutions SAP enhances all of its security products, specifically in the area of threat intelligence and cloud security SAP establishes security as a differentiator and business enabler for its PaaS, SAP Cloud Platform Customer 48 This is the current state of planning and may be changed by SAP at any time.

48 Related road maps Technology Platform security related road maps Related product road maps available on sap.com/roadmaps: SAP Single Sign-On SAP Identity Management SAP Cloud Platform Identity Authentication (formerly SAP Cloud Identity) SAP Cloud Platform Identity Provisioning SAP Enterprise Threat Detection SAP NetWeaver Application Server, add-on for code vulnerability analysis SAP Cloud Platform Customer 49

49 Thank you Road map contact for customers and partners Gerlinde Zibulski Director SAP Security Product Management

50 Key links for more information For customers and partners Key links SAP Road Maps SAP Community IT Planning Resources SAP Innovation Discovery SAP Security Community Where to go to provide product feedback and ideas SAP Idea Place Influence programs SAP User Groups Customer 51

51 Appendix

52 Acronym glossary Acronym Full Text EU GDPR REST RFID SAML SAP GRC SCIM SOC SPNEGO SSO EU General Data Protection Regulation Representational State Transfer Radio-frequency identification Security Assertion Markup Language SAP Governance, Risk, and Compliance System for Cross-domain Identity Management Service Organization Controls Simple and Protected GSSAPI Negotiation Mechanism (GSSAPI: Generic Security Service Application Program Interface) Single Sign-On X.509 In cryptography, X.509 is a standard for a public key infrastructure (PKI) Customer 53

53 2017 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. Please see for additional trademark information and notices. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP SE or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP SE s or its affiliated companies strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forwardlooking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions. Customer 54

54 2017 SAP SE oder ein SAP-Konzernunternehmen. Alle Rechte vorbehalten. Weitergabe und Vervielfältigung dieser Publikation oder von Teilen daraus sind, zu welchem Zweck und in welcher Form auch immer, ohne die ausdrückliche schriftliche Genehmigung durch SAP SE oder ein SAP-Konzernunternehmen nicht gestattet. SAP und andere in diesem Dokument erwähnte Produkte und Dienstleistungen von SAP sowie die dazugehörigen Logos sind Marken oder eingetragene Marken der SAP SE (oder von einem SAP-Konzernunternehmen) in Deutschland und verschiedenen anderen Ländern weltweit. Weitere Hinweise und Informationen zum Markenrecht finden Sie unter Die von SAP SE oder deren Vertriebsfirmen angebotenen Softwareprodukte können Softwarekomponenten auch anderer Softwarehersteller enthalten. Produkte können länderspezifische Unterschiede aufweisen. Die vorliegenden Unterlagen werden von der SAP SE oder einem SAP-Konzernunternehmen bereitgestellt und dienen ausschließlich zu Informationszwecken. Die SAP SE oder ihre Konzernunternehmen übernehmen keinerlei Haftung oder Gewährleistung für Fehler oder Unvollständigkeiten in dieser Publikation. Die SAP SE oder ein SAP-Konzernunternehmen steht lediglich für Produkte und Dienstleistungen nach der Maßgabe ein, die in der Vereinbarung über die jeweiligen Produkte und Dienstleistungen ausdrücklich geregelt ist. Keine der hierin enthaltenen Informationen ist als zusätzliche Garantie zu interpretieren. Insbesondere sind die SAP SE oder ihre Konzernunternehmen in keiner Weise verpflichtet, in dieser Publikation oder einer zugehörigen Präsentation dargestellte Geschäftsabläufe zu verfolgen oder hierin wiedergegebene Funktionen zu entwickeln oder zu veröffentlichen. Diese Publikation oder eine zugehörige Präsentation, die Strategie und etwaige künftige Entwicklungen, Produkte und/oder Plattformen der SAP SE oder ihrer Konzernunternehmen können von der SAP SE oder ihren Konzernunternehmen jederzeit und ohne Angabe von Gründen unangekündigt geändert werden. Die in dieser Publikation enthaltenen Informationen stellen keine Zusage, kein Versprechen und keine rechtliche Verpflichtung zur Lieferung von Material, Code oder Funktionen dar. Sämtliche vorausschauenden Aussagen unterliegen unterschiedlichen Risiken und Unsicherheiten, durch die die tatsächlichen Ergebnisse von den Erwartungen abweichen können. Die vorausschauenden Aussagen geben die Sicht zu dem Zeitpunkt wieder, zu dem sie getätigt wurden. Dem Leser wird empfohlen, diesen Aussagen kein übertriebenes Vertrauen zu schenken und sich bei Kaufentscheidungen nicht auf sie zu stützen. Customer 55