by Cyril Hauppert | Oct 30, 2026 | Blog
I’ve seen SoD exercises generate enormous numbers of findings. Hundreds. Thousands. Sometimes far more. And technically, the report may be correct. But it leaves the security team with another problem: ๐ช๐ต๐ฒ๐ฟ๐ฒ ๐ฑ๐ผ ๐๐ผ๐ ๐๐๐ฎ๐ฟ๐? Not every conflict carries the same...
by Cyril Hauppert | Oct 28, 2026 | Blog
I don’t believe the goal of SAP security should be to eliminate sensitive access. That wouldn’t be realistic. People need to perform critical activities. Someone has to: โข Create or change master dataโข Approve transactionsโข Administer rolesโข Maintain...
by Cyril Hauppert | Oct 23, 2026 | Blog
A role can look perfectly reasonable on paper. The name makes sense.The assignment was approved.The user clearly needs it. And yet the real issue may be sitting much deeper inside the role. One authorization object.One activity value.One unrestricted field.One range...
by Cyril Hauppert | Oct 21, 2026 | Blog
When reviewing SAP access, people naturally look at roles. Which roles does the user have? Are the roles approved? Does the role name make sense? All useful questions. But sometimes the interesting part isn’t the role. It’s what is sitting ๐ถ๐ป๐๐ถ๐ฑ๐ฒ it. โข A...
by Cyril Hauppert | Oct 19, 2026 | Blog
Dormant accounts are easy to categorize as a cleanup problem. An account hasn’t been used. Someone should probably remove it. Put it on the backlog. Move on. But I think that misses the bigger question: ๐ช๐ต๐ฎ๐ ๐ฎ๐ฐ๐ฐ๐ฒ๐๐ ๐ฑ๐ผ๐ฒ๐ ๐๐ต๐ฒ ๐ฎ๐ฐ๐ฐ๐ผ๐๐ป๐ ๐๐๐ถ๐น๐น ๐ต๐ฎ๐๐ฒ? An unused account...
Recent Comments