Risk free authorization provisioning with SAP GRC Access Control the National Lottery Belgium

Transcriptie

1 Risk free authorization provisioning with SAP GRC Access Control the National Lottery Belgium Your logo Gert De Pauw The National Lottery Belgium Chris Walravens Expertum SAPience.be TECHday 13 1

2 Agenda The Players Project Triggers / Challenges SAP GRC Access Control Implementation Phases Project Benefits SAPience.be TECHday 13 2

3 The National Lottery Kanalisatie Wet van 19 april het beheerscontract tussen de Belgische Staat en de Nationale Loterij: sociaal verantwoordelijke en professionele aanbieder van spelplezier met twee essentiële doelstellingen : het spelgedrag kanaliseren en zo een alternatief bieden voor privé en/of illegale spelen de bestaande gebruikers van loterijen en kansspelen aantrekken met een modern en aantrekkelijk aanbod, zonder evenwel de omvang van de markt uit te breiden Grootste mecenas van België Op een verantwoorde manier Financiële steun aan organisaties en manifestaties van publiek belang: 225,3 miljoen euro aan subsidies rond de thema's sociaal, sport, cultuur, familie, wetenschap en nationaal prestige worden door de ministerraad goedgekeurd. Sinds 2002 stort de Nationale Loterij 27,44% van het globale jaarlijkse subsidiebedrag rechtstreeks aan de drie (Vlaamse, Franse en Duitstalige) Gemeenschappen. Sociale of naamsponsoring van initiatieven ten voordele van de integratie en het welzijn van minderbegoede bevolkingsgroepen (b.v. Restos du Coeur, eindejaarsdiners, bezoeken aan evenementen en tentoonstellingen aan verminderd tarief) Actief en op een autonome manier bijdragen tot de preventie en behandeling van gokverslaving dankzij de steun aan initiatieven in die richting SAPience.be TECHday 13 3

4 The National Lottery One of the biggest retail networks in Belgium 5240 Stores Independents working on commission and selling our products SAPience.be TECHday 13 4

5 Delaware History Founded in 1981; has been part of Bekaert, Andersen and Deloitte Independent partnership since 2003 Today 850+ professionals Belgium, China, Singapore, France, Luxembourg, The Netherlands & US Recipe Aligning business and technology Combining strengths, delivering solutions Philosophy Entrepreneurship, Care, Respect, Team spirit, Commitment SAPience.be TECHday 13 5

6 Expertum History Founded in April 2006 by 2 ex-sap BeLux employees Partnerships Today Team of 50+ SAP Experts and Project Managers Mission Exceed client expectations by providing top-quality expertise Provide our people a safe environment for personal and professional growth Strength Highly skilled & experienced SAP consultants in all SAP areas, combined with a wide industry knowledge in several domains SAPience.be TECHday 13 6

7 Expertum Competence Areas Finance & Controlling (FI/CO) Business Intelligence (BI:BW/BO + HANA) Project Management (PM) Knowledge Management - Product & Service Development Supply Chain Management (SCM) Product Lifecycle Management (PLM) Focus GRC team SAP Security & Authorizations SAP GRC Access Control SAP GRC Process Control Governance, Risk, and Compliance (GRC) Application Lifecycle Management (SolMan +NW) SAP Identity Management SAPience.be TECHday 13 7

8 Project Triggers / Challenges Segregation of Duties Automated Processes Transparency Audit Trails Monitoring & Reporting Controlled Access Risk Prevention Business Ownership SAPience.be TECHday 13 8

9 SAP GRC Access Control Accurately identify and analyze access risk violations in real-time Remediate and mitigate conflicts for users and roles Continuously monitor access risks and user assignments across the enterprise Analyze & Manage Risks (AMR) Emergency Access Management (EAM) Self service emergency access activation Centrally approve and manage emergency access or all SAP systems Detailed usage logs for comprehensive emergency access reviews Centralized business role management Enforced compliancy to format & SOD rules Automated role governance process involving business & technical owners Business Role Management (BRM) Provision & Manage Users (PMU) Self service user access request process Preventive risk analysis in user provisioning Automated workflow for efficiently approving requests Streamline and automate reviews of user access SAPience.be TECHday 13 9

10 SAP GRC Access Control First Belgian Company Using all 4 Modules SAPience.be TECHday 13 10

11 Implementation Phases Analyze & Manage Risk Emergency & Access Management Provision & Manage Users Phase 1b Phase 2 Phase 1a 01/11/ /07/ /12/ /10/2013 SAPience.be TECHday 13 11

12 Analyze & Manage Risk Bridge Business - IT Proactive Risk Analysis Analysis Engine Root Cause Analysis Rule Set Detailed Reporting SAPience.be TECHday 13 12

13 Emergency Access Mgmt Automated Notifications Controlled Access Logging Activities Only Approved Access SAPience.be TECHday 13 13

14 Provision & Manage Users Automated Provisioning Audit Trails Role & Risk Ownership Eliminate IT Involvement Preventive Risk Analysis Workflow Based Approvals SAPience.be TECHday 13 14

15 Implementation Phases SOD Remediation HR Trigger Approval Delegation Phase 1b Phase 2 Phase 1a 01/11/ /07/ /12/ /10/2013 SAPience.be TECHday 13 15

16 Intermediate Phase Delegation of Approvals Automated User Creation Clean-up of Access Rights Triggered by Onboarding SAPience.be TECHday 13 16

17 Implementation Phases Technical role design Business role design (Composite roles) Position Based Security Business Role Management Phase 1b Phase 2 Phase 1a 01/11/ /07/ /12/ /10/2013 SAPience.be TECHday 13 17

18 Business Role Management Automated Notifications Transparency Automated Access Removal Workflow Based Approvals Embedded Risk Analysis Centralized Role Documentation Role & Risk Owners SAPience.be TECHday 13 18

19 Risk Reduction SAPience.be TECHday 13 19

20 Project Benefits Rule Set Segregation of Duties Automated Processes Logging Activities Bridge Business - IT Monitoring & Reporting Clean-up of Access Rights Controlled Access Transparency Workflow Based Approvals Audit Trails Only Approved Access Analysis Engine Risk Prevention Root Cause Analysis Delegation of Approvals Automated Notifications Business Ownership Eliminate IT Involvement SAPience.be TECHday 13 20

21 LEARN FROM THE EXPERTS SAPience.be TECHday 13 21

22 Thank you! Gert De Pauw Senior SAP Manager The National Lottery gert.depauw@nationale-loterij.be Chris Walravens GRC Competence Lead Expertum chris.walravens@expertum.net SAPience.be TECHday 13 22