Soterion for SAP

Short Summary

SAP security and GRC are increasingly critical as organizations modernize core business systems (HR, ERP, CRM, SCM, BW) and add new technology pillars such as SAP HANA, big data, and cloud solutions. Maintaining security and compliance across a continuously changing SAP landscape is driven by legal and regulatory requirements, but also by the need to protect intellectual property and highly sensitive data such as customer information. Mature security programs embed controls across processes and systems, spanning areas from audit and fraud management to identity and access management (IAM), risk management, and process management.

Traditional SAP security emphasizes access governance: managing users, roles, profiles, authorization design, lifecycle workflows, approvals, and recertification, alongside enforcing segregation of duties (SoD) and least-privilege principles. However, SAP security must extend beyond authorizations to secure the full technology stack: hardened operating systems, restricted network access, disciplined patch and update management using available vulnerability and Security Note information, and best-practice configuration of SAP and third-party components. Given evolving internal and external threats, detecting information leakage and enabling real-time anomaly detection with analytics, notifications, and automated responses is increasingly important.

Soterion, headquartered in Johannesburg, delivers GRC software focused specifically on SAP environments, differentiating through ease of use and business-centric user interfaces. It offers on-premises deployment, managed services (including SoD expertise for smaller organizations), and a SaaS option (Soterion Compliance Cloud Platform) with pay-per-use access risk management. Because it runs as an independent application interfacing with SAP (not an ABAP application), it enables a modern UI and supports planned extensions to SAP SaaS services such as Ariba and SuccessFactors. Its modules include Access Risk Manager (enhanced by historical transaction usage analysis and cleanup projections), Basis Review Manager, Elevated Rights Manager, Periodic Review Manager, Employee Self-Service with risk impact analysis, and SAP Licensing Manager. Key strengths are usability, dashboards, drag-and-drop analysis, and graphical business-process context; challenges include limited SAP SaaS coverage today, lack of user lifecycle management, and a smaller partner ecosystem.

Interesting Facts

• SAP security and GRC are becoming more important for many organizations.
• Traditional enterprise systems listed include HR, ERP, CRM, SCM, and BW.
• The move toward SAP HANA, big data, and cloud solutions introduces an additional technology pillar.
• Soterion is headquartered in Johannesburg, South Africa.
• Soterion provides three deployment options: on-premises software, managed service, and SaaS via the Soterion Compliance Cloud Platform.
• The SaaS approach is based on a pay-per-use model and focuses on access risk management.
• Soterion for SAP runs as an independent application interfacing to SAP rather than as an ABAP application.
• Access Risk Manager incorporates historical transaction usage data in addition to authorization analysis.
• Basis Review Manager includes parameter checking and checks for wildcard transaction usage in production environments.
• Periodic Review Manager supports user access reviews as well as controls review and ruleset review.

Notable Quotes

• “Ensuring an adequate level of security and compliance for the continuously changing SAP infrastructure system landscape is of utmost importance.”
• “Beyond that, more and more organizations understand that providing an adequate level of security is a key requirement for protecting the organization’s intellectual property”
• “Conventional SAP Security focuses on Access Governance, i.e. the management and control of authorizations, users, roles and profiles.”
• “Being highly important criteria, these business aspects must not be the only focus when it comes to SAP security.”
• “Detecting and preventing information leakage are probably one of the most important aspects when it comes to protecting essential data assets.”
• “Soterion focuses only on delivering GRC products for SAP environments.”
• “Soterion for SAP isn’t an ABAP application that is locked into the SAP ecosystem, but runs as an independent application interfacing to the SAP ecosystem.”
• “While analysis of the static authorizations within SAP environments is common, adding the historical usage data provides better insight into the real access risks”
• “Risk clean-up wizards support the users in mitigating access related risks, but also in optimizing the role model.”
• “A specific strength is the graphical representation of business flows, which helps users in understanding the context of authorizations”