Gérez la confidentialité, la sécurité et les risques liés à vos données SAP
Masquez vos données SAP, minimisez les risques liés à la confidentialité et à la sécurité des données et conformez-vous aux réglementations en matière de confidentialité des données.
We see every day the news coming out in the press that there are hacking leaks throughout the world. A lot of big suppliers are working for us. They all have access to the test systems. Now when we copy the data, we're bound to protect their personal and sensitive information. For the first time, we now see our real risk exposure, which was even higher than what we anticipated. Compliance was no longer optional. The biggest challenge was that it had gotten really complicated over the years. The complexity of the implementation of GDPR is not only about anonymizing the system, but also archiving a lot of data. We have been doing that quite manually, but at some point, we couldn't make the next step. There's no way we can fix it. We had a very good conversation with EPI-USE Labs, and all the boxes were ticked. Without Soterion, we would have been running blind. And we now have it connected to each of our SAP systems, and we're literally using it on a daily basis. It was really important to have this kind of solution implemented for us. And, of course, it was implemented according to what the regulator was asking us. What we liked is the fact that you could scramble as you extracted the data. Even when we got the extracted files, there is no data in there that someone could have a look at. We work closely with our internal and external auditors, and they're quite happy with what we have done so far. With EPI-USE Labs products, I found it really useful that they're pre-empting my problems. It's really good to work with a supplier that understands the new legislation and is already there with a product.
Data Secure
Protégez vos données sensibles SAP
Anonymisation cohérente des données sensibles et personnelles dans les systèmes SAP non productifs. Minimiser les risques de sécurité tout en conservant la fonctionnalité des données.
Data Disclose
Retrouvez rapidement des données personnelles sensibles
Recherche instantanée d'un paysage SAP pour localiser, extraire et présenter l'empreinte d'une personne concernée à l'aide de Data Disclose.
Data Redact
Modifiez ou supprimer intelligemment les données sensibles
Data Redact permet d'expurger rapidement et de manière transparente les données des champs sans affecter l'intégrité référentielle. Les champs sensibles sont expurgés afin que le reste des données puisse être conservé.
Data Retain
Appliquez les règles de rétention à une sélection de données
Data Retain met en évidence de manière proactive les données sensibles à expurger sur la base de règles flexibles et prédéterminées, exécutées sur une base périodique déterminée par votre entreprise.
Hi. My name is Dudley Cartwright from Soterion. I'd like to spend a few minutes explaining: what is business-centric GRC and why it's so important for effective access risk management in SAP. Access risk is business risk. What is meant by this is that it is a business decision whether a user in the organisation should have certain access. As an example, if a person in your organisation requires access to both create the purchase order and release the purchase order, which is a typical segregation of duty, it should be your business users who decide if that risk is acceptable to the organisation or not. The challenge facing most organisations is that the business users often have very little visibility as to what access is problematic and is causing a risk violation. And if they do have some form of visibility, you often find that the business users don't understand the access risks being presented to them. SAP authorizations is very technical and complex, and most of the GRC solutions on the market have been developed from a technical audit perspective with very little consideration for its use by the business. These technical and complex GRC solutions are not well adopted by the business users, who generally push this responsibility back onto the IT teams. What ends up happening is that the IT teams run these GRC solutions as back-end solutions with minimal involvement from the business. You often find a high degree of underutilization of the GRC solution because of this. At Soterion, we believe that implementing the correct GRC solution is crucial to enhancing business buy-in and accountability. The GRC solution needs to convert the technical GRC language into a language that the business users can understand. Soterion does this by illustrating all access risks with supporting business process flows. This provides more context to the business users who can then make quicker and more informed decisions. The Soterion solution has been developed to empower the business users with their access risk management activities. Enhancing business accountability of access risk with the use of a business-centric GRC solution will enhance your first line of defence, which in turn will improve the organisation's overall risk awareness and your ability to manage your risk. Should you be interested in seeing a more detailed demo covering other use cases, please don't hesitate to contact us.
Whether you're divesting your enterprise or planning to migrate to a new platform or SAP S/4HANA, decommissioning your system presents a unique compliance challenge. How do you store your legacy data cost-effectively and securely?
Constant system and database updates make running an SAP display-only system too expensive, and the vast sea of interlinked data tables means you can't simply copy and store the relevant Transactional and Master data separately. There's also the issue of access risk. How do you manage who has access?
That's where Archive Central comes in. Archive Central is a role-based secure web solution to get business users access to historical data for Queries and Comparisons while simultaneously ensuring compliance requirements are met. Using proprietary software, we can read, select, and automatically load your SAP data into collections that you can access through a modern web application provided as Software-as-a-Service, allowing you to decommission your SAP system safely, and with the ability to import data from any common machine readable formats such as CSV.
Archive Central is capable of archiving data from non-SAP systems as well. Archive Central leverages the metadata to present a business entity for the user with all the related data rather than a set of disparate tables.
You'll be able to filter through data easily.
Our global search allows you to 'one click and type' to find the records you're looking for. It's also easily configurable, giving you the ability to customise the display to suit your needs. You'll also be able to store all common document formats and image files, so no need to worry about those old payslips, invoices, or certificates.
They can be stored and linked with the corresponding data for easy access. You'll be able to track who is viewing data records and what a particular user has done.
Don't let your legacy data hold you back. Securely store your legacy data for future Queries and Compliance with Archive Central.
The first challenge that most businesses face from a privacy point of view is actually understanding how much of the risk they're holding within their data. Most industries have spent, fifteen, twenty years customizing an SAP environment, making it correct for their business process, with no consideration as to how much data they're then proliferating into additional tables.
So actually then understanding and mapping that data is quite a large challenge especially because the people that built them have likely retired, moved on, and gone through natural attrition.
So it does create quite a large business challenge, and to be able to build your business case for an investment in a privacy solution you first need to know how much risk you are mitigating to be able to follow it through.
So to help with that, EPI-USE Labs have utilized our data model mapping that we've been using for the last twenty years to manage SAP data to build a discovery program. Now unlike some of the other competitors on the market, EPI-USE Labs are utilizing SAP domain knowledge that we've built to understand the data dictionary within your system, and we're able to complete a key search of the data elements within that environment based on the list of PII data items that we've already identified.
The output list is then validated against whether the data is actually populated because, of course, just because it's in the system doesn't mean you've actually populated it. And we'll then go through a workshop and detailed analysis process with one of our professional services consultants where we will analyze and understand how we can integrate that data back to a data subject for a customer, a vendor or an employee, but also understand what values are maintained and map out that PII challenge for your SAP system.
We collect all that information into a single document that has both the business functional requirements from the workshop, as to what retention periods you would like and how data should be affected based on those retention periods - so whether it should be cleared or transformed to a new value, and the same for non-production, for a system copy that you're going to use for testing, you need to have the real data from Production to improve your DevOps process.
But you can't have the real data because that is a PII risk, and you would have to have informed and explicit consent from every data subject in your environment to use that data as testing, and no company has entered those clauses into a contract so far to be able to say they're ready. So with that documentation, you have the business requirements of how data should be transformed and then also the technical specification of exactly which tables and fields grouped according to data type to be able to understand where the names, where the telephone numbers, where the bank details exist within the environment.
Additionally we now have an enhanced discovery working with one of our strategic partners Soterion. They offer GRC solutions as an alternative to SAP GRC. They have pre-delivered rule sets that are able to analyse your segregation of duties risk. They also have specific rule-sets to review your access to privacy data, to be able to understand who can actually see sensitive data within your SAP system.
We also have queries to be able to understand where there's cross legal jurisdictional access. So where somebody from the US is able to access European employee data or vice-versa. Through that analysis, we're able to provide a clear risk assessment of both the access to sensitive data, and where that data is within your environment.
Both of these options come as a license free, there is no license cost upfront, there is some professional services cost for around about one and a half to two weeks elapsed time, so in a very short turnaround period we're able to provide you this documentation, which we've seen from some of our clients is being used as audit evidence and passed through to their auditors to be able to help them understand your data model and how you're compliant to the laws.
So the data discovery and enhanced data discovery are available from your Account Executives, and we would be happy to discuss them with you.
As well as the output of the document, we will also then give you a fixed price, fixed scope implementation cost if you were to choose EPI-USE Labs as your privacy partner to be able to manage that data moving forward.
Aker Solutions a réduit les risques d’accès de 85 % grâce à Soterion
Comment Elkjøp a maîtrisé ses risques d'accès en quelques jours
Conformité RGPD : Comment ENGIE a mis en œuvre la Data Privacy Suite pour SAP
Maintenir l'ordre et la sécurité dans les données de la police d'Avon et Somerset.
Nikon obtient une vue d'ensemble de ses risques grâce à Soterion
Velux utilise Data Sync Manager pour sécuriser ses données de test SAP
Rabobank fait confiance à DSM pour la conformité réglementaire
MAPA (NUK & BILLY BOY): Une protection adaptée des donnés SAP HCM sensibles
JM adopte des solutions pour se conformer au RGPD
Le parcours de Masimo Consumer vers la conformité SOX avec Soterion
Comment Endeavor a amélioré sa conformité GRC pour SAP avec Soterion