Why NO MONKEY

The biggest threat to your SAP Security ... is coming from INSIDE your organization!

As the SAP landscape grows, so does it's complexity and attack surface, leaving most organizations to face a problem they're ill-equipped to understand. To keep themselves safe they rely on their three lines of defense. The three lines of defense model describes the roles and tasks related to risk management across an organization's departments and external functions.

The problem is these departments all speak different languages, have different levels of expertise, knowledge, and perspectives of the SAP ecosystem... that's when the monkeys show up, breaking down communication and understanding in your lines of security defense, slowly, from the inside.

Monkey trouble in Your SAP Security Defense

Before we explain how monkeys break down your SAP security defense, let us first clarify what exactly monkeys are. To be clear, monkeys are not people or positions. They are unknown and unaddressed obstacles hidden within the foundational structures of your three lines of defense that prevent your departments and employees from unifying to see, hear, and communicating SAP security issues holistically. They increase your risk, vulnerabilities, and decrease your organization's ability to mitigate and respond. As you remove the monkey from each line of defense, you improve knowledge, understanding, communication, and culture within your organization.

SAP Security Defenses United They Stand, Divided They Fall

1st Line of Defense – The SAP Operations Department (SAP Ops)

When the NO SPEAK Monkey is present in your SAP Operations Department, it prevents team members from communicating potential threats.
 
SAP runs on its own unique code. We all know that! The SAP experts speak the SAP coding language really well. We like to refer to as 'SAPanese.' The problem is, they don't understand the SAP landscape in the context of security or compliance. Their primary focus is to keep the application running. More times than not, they lack the in-depth understanding and knowledge needed to work together with the other departments to protect the system holistically. However, it is their input that the Security and Audit department relies on to make strategical security-related decisions.

2nd Line of Defense – The Security Department

When the NO SEE Monkey is present in your Security Department, it prevents team members from seeing potential threats by putting them in a language the department doesn't speak.
 
The security department struggles with the visibility of SAP systems. Critical reports and data are written in ABAP® code. Security experts, for the most part, don't speak SAPanese! It's difficult to offer meaningful security solutions on threats that you can't detect because you don't speak the language you need to see them so.

3rd Line of Defense – The Audit Department

When the NO HEAR Monkey is present in your Audit Department, it prevents team members from hearing about potential threats needed to prioritize vulnerabilities or give accurate mitigation advice.
 
Audit experts come from a business background, and their role rotates around the business aspects of security. It uses these assessments to advise on how to optimize security processes. Like the Security line of defense, they don't speak SAPanese either and often rely on reports from 3rd party vendors and other departments to assess the effectiveness of risk management processes and controls.

Protect Your SAP Ecosystem - make sure to have NO MONKEY!

To safely run your SAP ecosystem, the goal is to have NO MONKEY in each line of defense. Now you understand how we came up with the name. Clever right! I told you it would all make sense. The next question is, 'How do you get rid of the monkeys?' The answer, of course, is SAP Security training specific to the needs of different departments and teams! The process of mitigating SAP security and cyber risk can not be accomplished by technology alone. As your SAP landscape expands, so must your organization's internal expertise on how to keep it secure. It is essential to reduce the knowledge gaps, train employees, and unify your three lines of defense to tackle the security plan. To execute SAP security strategies that work, you must have a dedicated SAP security perspective. You do this by training your departments, empowering your employees, and establishing an organization-wide culture of security - the NO MONKEY Academy and Advisory can help you do it.