Thomas Neudenberger

1. Thomas Neudenberger COO, realtime North America inc. Indisputable Data and Transaction Protection for SAP

2. Is your SAP System safer than a cruise ship? • FBI charges Rick Ehlert, • Holland America passenger, • for releasing ship's anchor • Officials say 44-year-old Rick Ehlert was a passenger on Holland America's 1,260-passenger Ryndam bound for Tampa when he entered a restricted area and let the ship's rear anchor loose: • http://www.wtsp.com/news/local/story.aspx?storyid=159538 • How is it possible that a drunken customer even gets access to the restricted area? • How did he get access to the “function” that allowed him to release the anchor? • Why were there NO sufficient security measures in place such as cameras? • How hard would it be to protect releasing the anchor with a key operated switch? • Why didn’t anybody see the DANGER until something actually happened? • Should the cruise line be charged with negligence for endangering customers?

3. Business Pain Points at Every Organization • 93% of fraudsters were first time offenders • A company’s average loss was 7% of their revenue • The first single incident cost companies $239,000 in damages* • Fraud schemes continued for years - many are NEVER detected • Bad Press could decrease revenue and shareholder value • Most catastrophic fraud is committed with a stolen user profile! • The financial damage of the “first single incident” increased from $175,000 in 2008 to $239,000 in 2009! Damages reach billions! • The Association of Certified Fraud Examiners (ACFE) 2008 Fraud Study – links on the last page!

4. Technical Pain Points at Every Organization • Overwhelmed with access control efforts for all users • Gaps in Security Roles tend to "over permit" users (statistics) • No technology to protect critical functions or the actual data • Restrict Access for tables or programs in SE 16 / SE 38 • Need to block or mask critical information in Systems • Establish “true” SoD’s and clear accountability • Extensive password sharing I will give you my password if you tell me yours! IT will cost you dinner! Password1

5. History - Passwords Become Easier to Obtain Passwords have been around since the first computers in 1963, and while they might have been fairly secure back then, technology is evolving and is making them more vulnerable on a daily basis: • Before the Internet intruders had to physically break into a company first • Password crackers, computers and technologies get faster every day* • Hacking tools are now legally sold in stores as Password Recovery tools • Physical and logical key loggers can be implemented without detection • Hidden cameras and even cell phones can easily video tape passwords • Surveillance cameras are everywhere where users log on (example: airport) • Algorithms can decrypt passwords just based on sound (record it) • Users have too many passwords and are forced to write them down • Systems require frequent password renewal (forcing users to write them down) • Users are forced to create more complex and longer passwords (can’t remember) * Recent News: Computer clustering allows the cracking of complicated passwords in 20 minutes instead of 5 days!

6. Many Ways for Intruders to Get Passwords • Look in desk drawers or on the “yellow sticky note” • Look over shoulders of co-workers (shoulder surfing) • Videotape it - watch for people with a cell phone around you • Ask colleagues – 40% admit to sharing passwords • Get emergency password (administrators / security guard) • Call hotline to get password reset for any user • Associate with owner (pet, family, hometown, birthday) • Check unencrypted .ini files • Try SAP default password for SAP* - 06071992 • Key Catcher, Password Cracker – Now: Recovery Tools • Monitoring / Sniffers (transfer from GUI not encrypted) Download the “Fishing for Passwords” document at www.showpasswordsthefinger.com

7. Increase Security & Accountability for SAP Smart Cards can still be lost, stolen, copied and shared and they offer no indisputable accountability The indisputable accountability will be much stronger using biometric technology 82% of all SAP passwords are written down (SAP-Info Online) #1 Pain Point at any SAP customer is “Password Sharing” Use a combination of 2 or 3 methods for ultimate security and accountability!

8. bioLock is Compatible with Almost any Device • All UPEK sensor devices including Fips 201 • All Authentec Sensor Devices (true print tech.) • Secugen Product Line with optical device • Most Leading Laptop with build in swipe sensors • Most smart card readers and keyboards Contact us for a compatibility list Devices cost between $50-$150 and are only needed for a few 100 Users Note:

9. 5 Level Protection SAP System Level I Level II Transactions Level III Any Field In addition to Access - Protect Critical Data Technology to enhance SSO and Access Control Other technologies protect the outside while this technology will protect your system from the INSIDE Outside SAP Before you access SAP: Inside SAP AFTER you access SAP: Existing/Ongoing/Future Projects Level IV Exceeding Values Single Sign On Access Controls Identity Management Microsoft Forefront Kerberos / Tokens Smart Card / CAC Active Directory Etc. Level V Dual Signature

10. Prevent Sharing of SAP User Profiles Your security guard will definitely stop this guy at the main gate!!! Even though this guy identifies himself as “Tom N.” on his space suit… Your security guard will ask to compare his face (biometric features) with his photo ID (biometric template) and perform a manual face recognition process to confirm ID. Without using biometrics we can only identify “Space Suits” with names on them (SAP User Profile Names) walking around in the most critical part of our organization – the SAP System. You have NO WAY of identifying WHO is using the space suit or SAP user profile – nor can your reject a user based on their identity As a first step, the technology will uniquely identify the USER behind the “Space Suit” (User Profile) and prevent the challenge of unauthorized access through password sharing!

11. Override ANY SAP Authorizations In a hotel you access your room with a key card How many other people have key cards that open YOUR door? How do you protect yourself, your family or your valuables at night? Before you go to sleep in a hotel room, you lock the swinging “door bar” and “override the access” for other, normally-authorized users This technology allows you to place swinging door bars anywhere in the SAP system and override existing authorizations. A user needs specific permission from our technology to access protected functions and data.

12. bioLock Independent Additional Protection Override SAP Security Finance PO HR Password and / or Authorized SAP User Profile Access bioLock permits users via biometric template, password or smart card – the protection is defined in bioLock and “blocks” the SAP User Profile Access

13. Permit VIP Power Users – Not all Users Before bioLock you had to worry about protecting access for ALL SAP Users… • Now you identify and protect selected critical functions in your system • You PERMIT Power users that you WANT to “access critical functions” • ALL OTHERS will not be able to access them – even SAP ALL • Functions can either be protected Globally or on an Individual Basis • You only have to “permit” a few 100 Power Users Only Power Users with specific permissions will have access Normal Users - and ALL OTHERS - will always be denied

14. Limit Access to Permitted VIP bioLock Users Example: 6000 Named SAP Users Fraud is mostly committed by stealing or cracking a password to access profiles with critical, extended authorizations 2000 Users with any roles to “somehow” critical data The threat comes from the inside and outside! 1000 Users with restricted roles to critical functions Foreign Hackers External Employees VIP Only: 500 Permitted bioLock Users for most critical functions Terrorist Groups Former Employees Ultimate Data Protection Auditors Consultants

15. Additional bioLock Security Existing SAP Security An Additional Integrated Layer of Security The technology is completely integrated into SAP and adds an additional layer on top of your existing security: it will never “touch” or change your existing security roles or profiles! Note: bioLock is installed into realtime’s own name space (/realtime) within your SAP system via SAP transports. It is completely integrated into SAP!

16. Protect “Anything” Valuable in the SAP System Lock “anything” within the SAP system by simply installing a predefined ABAP code (the swinging door bar) Quickly and easily secure: • Logon to a User Profile (e.g. Admin) • Transactions (e.g. HR / PO / Finance) • Infotypes (e.g. 008/167 etc.) • Buttons (e.g. Print / Export / Execute) • Display (e.g. Balance Sheet / ) • Execute (e.g. protect execution of anything…) • Tables within SE 16 / SE 16N • Programs within SE 38 • Values (e.g. wire transfer of a certain amount) • Screens (e.g. export control / ITAR ) • Mask Fields (e.g. make certain fields invisible) • and more… (e.g. compliance, SoD, SOX etc.) Every “door bar” has a unique id number and can now be activated and controlled via bioLock Allow a few 100 Power Users to “open” the “door bar” with biometrics and/or smart card authentication (CAC)

17. Proof is Always in Writing for the Auditors bioLock uniquely identifies the ACTUAL USER with biometrics SAP’s log file can only identify the SAP User Profile You only know that “space suit” Tom N was used bioLock rejects and shows in the LOG files which UNAUTHORIZED user tried to use colleagues SAP user profiles

18. General Pain Points for Customers • Securely protect any confidential, private, classified or high-value data • Mask screens , fields, tables and protect any secret information • SAP Logon: Unauthorized users use or share SAP User ID’s even at different locations at the same time • Consultants: Internal and External consultants with limited loyalty to any company have extended access • HR: Protecting and securing HR info including health insurance, salaries and social security numbers • Finance: Prevent tampering with payment release, salaries, wire transfers, requesting or changing budgets • Balance Sheets: Access to critical company information • Research Data: Research data is stolen or changed (espionage) • Production Data: Components of critical production values such as chemicals in drugs are changed • Purchasing: Unauthorized users purchase unauthorized items • Workflow Approval: People use supervisors’ passwords • Fast User Switching: Users are supposed to log in and out (bank, hospital, warehouse etc.) • Access to critical functions that concern National Security such as power grids or water supplies • Remember multiple passwords that could require up to 15 characters each • True Identity Management / Compliance (Sarbanes-Oxley, Section 404, Internal Controls) • Many critical information are visible in QA Systems and too many people have legal access

19. bioLock enforces SoD’s: • bioLock prevents logon to other user profiles • bioLock identifies and permits authorized users for tasks • True SoD’s can be established based on biometric templates • The log file shows identified users, establishes indisputable accountability and helps to convict violators and intruders • bioLock deters fraud by requiring users to identify themselves Best Practices: Challenge with role based SoD’s The Challenge of Role Based SoD’s: GRC technology (or competitive products) identify and prevent that one SAP user can create a purchase order, approve it and issue a payment • The technology can only identify the conflicts based on user roles • Bad guys simply logon with different user profiles to overcome SoD’s • They circumvent SoD’s and it is difficult to prosecute, as criminals use multiple user profiles to commit fraud • Even if fraud is identified, criminals can still point fingers at others

20. The Solution: • Critical functions on all 3 computers are protected with bioLock • The biometric templates of all 5 users are assigned to all 3 computers so the 5 authorized users can switch between computers and execute protected functions • Unauthorized colleagues or customer can not execute the functions even if the computer is logged on since the template is not assigned Best Practices – Fast User Switching Example: Bank, Hospital, Warehouse, Customer Service, Call Center etc. Challenge: 5 employees use 3 different computers and don’t have the time to log in and out when switching places

21. The Solution: • Purdue is using bioLock for workflow payment approval • An automated workflow sends an email with a link to approver • Approver clicks the link and bioLock pops up a window • bioLock asks the user to authenticate themselves • bioLock approves the transaction in the web browser • Once done, the payment is immediately approved within SAP. Best Practices : Pharmaceutical Company The Challenge: Purdue Pharma L.P., a pharmaceutical company focused on meeting the needs of healthcare providers and the patients in their care • Financial workflow approval within SAP guaranteeing only executives can approve • bioLock was required to work within a web based system (browser based) • An email send to s supervisor had to trigger biometric approval in a web browser

22. The Solution: • bioLock dual confirmation group was enabled • 2 people have to authorize tasks • Both will be uniquely identified… • …and logged in the log file Best Practices: Banking / Finance System The Challenge: The oldest central bank in the world had multiple critical tasks in their financial application including opening balance sheets, approving budgets and issuing wire transfers • Groups of people had access to many parts of the finance system • The client needed to uniquely identify the “actual user” and log activities • Management requested that 2 individuals would authorize certain tasks

23. The Solution: • Rick Meshberger (left) installed biometrics • Access and changes are limited to uniquely identified users • A log file can proof, who did ‘what’ and ‘when’ Best Practices: Government HR / HIPAA The Challenge: Brevard County Government, home to NASA and the Kennedy Space Center is running SAP including HR • Multiple employees had access to extremely critical HR data • Misuse of the data by employees and others was easily possible • Brevard needed to protect and uniquely identify the actual SAP USER

24. Expert Statements – SAP TV Movie You are invited to view some expert statements at your convenience: http://realtimenorthamerica.com/download/Expert_statements.wmv Other SAP movies including bioLock: http://www.realtimenorthamerica.com/saptv.shtml 2010 NBC Crime Tracker NEWS interview at realtime’s headquarters: http://www2.tbo.com/video/2010/jan/07/fingerprint-security--15050/video-news/

25. Technology Review Prevents unauthorized actions and illegal access far more effectively than other security measures. Enables powerful protection of confidential information and data on the field level within the SAP System. Effectively blocks consultants, administrators, auditors and anyone that should not be permitted access to certain sensitive functions and data regardless of existing security permissions Establishes indisputable accountability, control and “true” SoD’s it is the next logical step in addition to Single Sign on and Access Control efforts

26. Key Learnings - Highlights Summarized • adds additional layers of security to the SAP system • protects organizations from the risk of MILLION dollar losses • is a proven technology backed by over 100 employees • is implemented and up and running in a few days • requires minimal training, configuration or maintenance • has an immediate ROI in the first year and very low TCO • is the only certified biometric technology available for SAP* *SAP ERP 4.6 certified in 2002 / SAP NetWeaver certified in 2006

27. bioLock permits Good Guys - blocks Bad Guys Even if your company has 1000’s of named SAP Users… bioLock will protect your entire SAP System from anyone else: Only a few hundred VIP Power users…. bioLock Terrorist Groups Insider Theft Need to be permitted with their “finger” (biometric templates) Outside Hackers • Most companies only need to protect a few hundred Power Users • Installation takes a few days and no user training is necessary • Minimal ongoing maintenance required Former Employees IT Consultants

28. Additional bioLock and Fraud Information Note: You must be in Slide Show Mode to click on the links!

29. ] • Thank you for participating. Please remember to complete and return your evaluation form following this session. For ongoing education on this area of focus, visit the Year-Round Community page at www.asug.com/yrc [ SESSION CODE: ASUG Florida Chapter Tampa Networking Event Wednesday, December 8, 2010