One Wildcard. Hundreds of users

One Wildcard. Hundreds of users

When reviewing SAP access, people naturally look at roles. Which roles does the user have? Are the roles approved? Does the role name make sense? All useful questions. But sometimes the interesting part isn’t the role. It’s what is sitting ๐—ถ๐—ป๐˜€๐—ถ๐—ฑ๐—ฒ it. โ€ข A...
Who has access to what?

Who has access to what?

Here’s a simple SAP security question: ๐—ช๐—ต๐—ผ ๐—ต๐—ฎ๐˜€ ๐—ฎ๐—ฐ๐—ฐ๐—ฒ๐˜€๐˜€ ๐˜๐—ผ ๐˜„๐—ต๐—ฎ๐˜? It sounds almost too basic. But there is a second part that makes it more interesting: ๐—–๐—ฎ๐—ป ๐˜†๐—ผ๐˜‚ ๐—ฎ๐—ป๐˜€๐˜„๐—ฒ๐—ฟ ๐—ถ๐˜ ๐—ป๐—ผ๐˜„? Not: โŒ After exporting three reportsโŒ After someone builds a spreadsheetโŒ After asking an...
“Everything is under control”

“Everything is under control”

I hear this quite often when talking with SAP security teams: โ€œ๐—ช๐—ฒ ๐—ต๐—ฎ๐˜ƒ๐—ฒ ๐—ถ๐˜ ๐˜‚๐—ป๐—ฑ๐—ฒ๐—ฟ ๐—ฐ๐—ผ๐—ป๐˜๐—ฟ๐—ผ๐—น.โ€ And most of the time, I believe them. The question is what ๐˜ถ๐˜ฏ๐˜ฅ๐˜ฆ๐˜ณ ๐˜ค๐˜ฐ๐˜ฏ๐˜ต๐˜ณ๐˜ฐ๐˜ญ actually means. Can you see, right now: โœ… Who has access to sensitive activities?โœ… Which users have...
Loading...