SAP data security in the digital age

The challenge of system integration

Digitized processes know no system boundaries. Using modern development platforms such as SAP S/4 Hana, thousands of sensitive data are exported from SAP to other applications, such as Microsoft Office, every day without any control.

Traditional, role-based authorization concepts reach their limits here and confidential files quickly fall into the hands of cyber criminals or insiders - whether intentionally or accidentally.

According to a Bitkom study, more than half of German companies have already been victims of industrial espionage, sabotage or data theft in the last two years - a financial loss of almost 55 billion euros per year.

The leaks are often found within the company's own ranks. 62% of the almost 600 companies surveyed stated that the relevant actions originated from their own employees. 41% confirmed corresponding activities from their business environment (competitors, customers, suppliers, service providers). [1]

Increasing pressure to act due to new EU GDPR

Although politicians are trying to curb data misuse with measures such as the EU GDPR, most companies are not yet up to the far-reaching, cross-process documentation obligations for personal data.

Although the law has already come into force and the transition phase is only due to last until May 2018, most companies feel ill-prepared. [2]

Some CIOs have even ordered the topic to be ignored altogether. A decision that could prove fatal for them. After all, those who fail to comply with the new requirements risk high fines of up to 20 million euros or four percent of their annual global turnover. [3]

Regaining control and rethinking for the long term

In order to effectively secure SAP data in the digitalized world, companies must first regain control over cross-system data flows.

Those responsible must know who exports which data and when, and ensure that it is protected across all applications. The same applies to background data transfer between SAP and other systems such as Microsoft or Oracle.

In the long term, the company-wide IT security concepts should also be reconsidered - from the type of data provision to the expansion of the role-based authorization system to include new, context-related data security concepts.

To the guide:
http://bit.ly/2xzyUrN

References:
[1] Economic protection in the digital world, Bitkom study 2017
[2] GDPR Report, Veritas Study 2017
[3] EU General Data Protection Regulation (EU GDPR), EU Regulation 2016