Designing ERP Access Governance Before Go Live With Pathlock

[00:00:00] The leading issue of agentic AI in businesses right now is ensuring agents act with compliance guidelines. And Denodo applies guardrails across your entire data estate. By aligning your company's data infrastructure under one system, these guardrails perform consistently across your platform. So start scaling your business and start with Denodo. Simply visit denodo.com to learn more.

[00:00:27] What happens when ERP transformation reaches its go live date before the business has resolved who can do what inside the system? Well, the consequences can extend far beyond just an audit finding. Access decisions influence transactions, supplier relationships and the processes that keep production moving.

[00:00:57] Throw in AI agents, they add another question. So how those controls hold when software can act through business systems at machine speed? That is a big question I want to explore today. And I found the perfect guest. His name is Chris Radowski, GRC expert and advisor at Pathlock. Chris previously spent 17 years at SAP. He's worked across access control, governance and security.

[00:01:27] And today we will discuss why risk belongs in transformation planning from the beginning. How privileged access differs inside business applications. And why periodic reviews can often leave gaps. And Chris will also explain the value of looking at what users did alongside the permissions they were given.

[00:01:48] So if you're a leader planning ERP or AI changes, I'm hoping today's conversation will offer a few insights around the role design, emergency access and maintaining of business continuity. But I've revealed far too much already, haven't I? Let me introduce you to my guest now. So thank you for joining me on the show today. Can you tell everyone listening a little about who you are and what you do? All right. Thanks so much, Neil.

[00:02:18] My name is Chris Radkowski. I'm a GRC expert and advisor at Pathlock. I've been at Pathlock for about a year and a half now. And before that, I was at SAP for 17 years. And I was the global solution owner for a collection of GRC products. The main one, the cash cow of the portfolio is SAP access control. And so I really focus a lot of attention on that for quite a long time.

[00:02:46] Many of you know that product was acquired by Versa. And so I joined what was left of the Versa team at SAP. And we grew that product into a number of others within the GRC domain.

[00:03:05] And I was responsible for the strategy for P&L and for the between 7,000 and 8,000 customers that bought it. And I also was involved with SAP security and data protection strategy. And it's interesting because inside SAP, it's kind of a constant yin and yang. Are we a security company? Can we sell security? What kind of security do I have to have?

[00:03:35] And so ultimately, that resulted in the cybersecurity portfolio that SAP continues to offer. And there are a number of products in there that I was involved with. But I'm absolutely having the time of my life at Pathlock. I was responsible for partnerships at SAP. And there's a type of partnership. It's called a SOLEX, a solution extension partnership that I sponsored Pathlock as well.

[00:04:04] They were Greenlight at the time, but they became Pathlock later on. And I sponsored that relationship and then had the opportunity to join the company about a year and a half ago. And so absolutely having the time of my life here, going around to lots of different events, a lot more externally facing activities that I'm doing.

[00:04:27] So the big events in the industry are SAP Insider in the U.S. and Europe. And there's SAP User Group events that are going on. So I'm participating in all that. Wow. Incredibly cool journey that you've been on there. As a man of a similar age, I still find it amazing and fascinating and exciting just how we've seen technology grow.

[00:04:53] And in particular, the last three years, of course, it is just incredible. But do you ever look back at how far you've come? It's a bit like the Steve Jobs quote that you can't join up the dots looking forward. It's only when you look back and see that. And then now, obviously, at Pathlock and how the stars have almost aligned there and you've got everything that you need at the right time. Do you ever sit down and reflect and think about that? I do. I do often.

[00:05:18] You know, it's important to kind of reflect on where you were to kind of judge where you might go as well. Yeah. You know, AI is upon us. I mean, I'm sure you've had a lot of AI podcasts, but, you know, it's a profound effect on or will be a profound effect on everyone. And I remember way back in the day, I think it was my parents maybe suggested, hey, you know, you better learn about computers. I think computers are going to be important in the future.

[00:05:46] And I think we're at that kind of moment now where, you know, you better learn about AI because it's going to be important going forward. My journey is, I don't know, maybe it's a little different. I had almost like two lives. Yeah. So I spent a long time in the aerospace industry. I was a, I was an engineer, electrical engineer and responsible for a component that went on the guidance system for commercial satellites.

[00:06:13] So, you know, everything you're seeing about space and SpaceX and, you know, satellite TV, you know, the important thing is that, you know, those satellites point at the earth and not often space somewhere. And so I was responsible for a component that went on the satellite, which was a completely different sort of industry. Right.

[00:06:34] And I had a, I had an opportunity to change and I somehow convinced someone that I knew about mobile devices and wireless communication. And they, they brought me on as a product manager for a company and, you know, in what became single sign on. Right.

[00:06:54] So that evolved into identity management, which involved into lots of other domains, which, you know, at, you know, if you look, go up the stack from network to network to, you know, operating systems to applications, we're really talking about identity management for, for, for business applications. You know, at least that's what my, my focus has been for quite some time now. Incredibly cool.

[00:07:22] And bringing you straight back down to earth and the present day ERP transformation programs. They're something that tend to celebrate automation. Yes. But also speed and efficiency. But I know a topic close to your heart here is why risk is so often missing from the boardroom conversation when we're talking about this stuff. So tell me a little bit more about that. And why you say that risk. Jeez, that's a great question.

[00:07:48] You know, one of the things that has been driving me in conversations a lot is that the sheer size and scale that our customers are operating in. And you know, when something isn't working right in your system, if SAP goes down, for example, I was talking to a large consumer goods company. And they were telling me that if SAP isn't working properly, I mean, literally trucks back up outside the factory and they can't make shampoo. Yeah.

[00:08:17] And it kind of puts it all into context where, you know, if something isn't working right within the ERP system, they can't receive goods. You can't process the goods you need to support any kind of manufacturing line. And that happens within shampoo. And you can imagine if you're a large supplier, the raw ingredients come on trucks. I mean, that's shocking in itself. But if you're an auto manufacturer and you have to stop manufacturing, even for a brief moment, it's massive.

[00:08:47] And so the risk involved in ERP cuts a couple different ways. You know, these systems are running businesses almost in their entirety. And so the risk of a security event, the risk of the system having to be brought down, the risk of compliance issue, the risk of material weakness are all critical when you're looking at an ERP transformation.

[00:09:14] And so the technology under the covers, I mean, there are significant differences. And so in these transformation programs, often, you know, it's a mad dash to go live. And so a lot of the times, you know, risk for particular certain types of risks aren't often thought of in advance.

[00:09:35] And that's one of the things at Pathlock that we really focus on, particularly when it comes to risk that's related to compliance activities, risk related to users who can, you know, manipulate or change, you know, financial information.

[00:09:55] The risk in, you know, the risk in reporting incorrect numbers to Wall Street, you know, and those kinds of things have legal implications that go far beyond just, you know, just the amount of fraud or something that could be committed.

[00:10:10] So when you are going through a transformation, one of the critical things you have to consider is the role design, you know, that's behind the scenes that grant users the entitlements they need to do their jobs.

[00:10:27] And at Pathlock, one of the key, one of the key things we focus on is ensuring that those roles don't have a toxic combination of entitlements that grant users the ability to steal things from the organization, transfer money to their friends or family, all these types of scenarios. And of course, a few months ago, you mentioned the early days of single sign on and identity management.

[00:10:54] And again, fast forward to present day, identity management means a whole lot more, especially as AI agents and automated workflows all gain access to SAP Oracle and Workday. So how are you seeing the definition of a privileged account changing? Well, there's a couple of things, you know, we have we've been trying to.

[00:11:15] We've been trying to differentiate a privileged account in a business system versus, you know, administrator accounts in sort of IT systems and privileged accounts in SAP can be granted a, you know, SAP all access, which is everything. And and so those those accounts can have incredibly sensitive and, you know, critical access.

[00:11:38] You can imagine what is the most sensitive thing your company, most sensitive information that your company wants to protect. You know, like, for example, you know, Coca-Cola wants to protect the formula. You know, NVIDIA wants to protect the designs for their, you know, their their advanced chips. And so who has access to that information is extremely critical.

[00:12:03] And within a company like Coca-Cola, if you could reverse engineer the materials they're buying, then you could conceivably figure out the formula. And so the access to those particular sets of authorizations on who's allowed to interact with the vendors in order that that that material to make the product is often highly protected and will will will be isolated down to just a few people. Right.

[00:12:28] And so privilege access is extremely critical and has to be managed very carefully. And as AI is coming along, it's just blurring the lines completely because you have users who are accessing systems that can perform functions, operations at a certain rate.

[00:12:48] And you have AI agents that are instead interacting with APIs for the application that can process transactions at a rate that's faster than any human conceivably could. So the ability to manage both API access, other interfaces for AI agents, as well as as user access is is a is a critical function of, you know, the app to consider for for privileged users. Yeah. Yeah.

[00:13:18] And I think it's safe to predict that we're going to see an explosion in identity management concerns, I should say. We've already seen a lot of solutions that are rising to meet those concerns or all the fear that surrounds it. So for business leaders listening, though, what are the most common warning signs that permissions and conflicting access rights have actually began to grow beyond an organization's ability to manage them?

[00:13:45] Well, this is a growing challenge and conflicting and toxic access used to be kind of related to, well, just the ERP system. But now as we as we're seeing the compliance regulations evolve, there are additional systems that are coming into scope. You know, Ariba, you know, SAP BTP, Salesforce and other kinds of systems are all coming into scope.

[00:14:09] So that's why it's so important to have a system in place where you can detect detect certain kinds of toxic access behind the scenes based on log data, based on transactional information and monitor that activity. So you can advise basis teams, the business on exactly what's going on.

[00:14:34] And the challenge with the challenge with AI is that a lot of users don't understand the security implications. And so you can grant an AI agent access if you give it your credentials and that AI access will act just like a user would. And it's hard to tell the difference when you're looking after the fact that, you know, it's a user that's, you know, or an AI agent that's executing those transactions.

[00:14:59] And so you need a combination of administrative controls, the controls who can grant those credentials and monitoring of the transactional, you know, events that are going on. So I think most business leaders are all in the same boat is that they're watching us very carefully. And, you know, maybe if they haven't worked on a corporate policy, they are thinking about it and what's acceptable and what isn't.

[00:15:23] Because users are just concerned about getting the job done and if they can do it easier, they might cut corners. And so I think a lot of organizations are dealing with that at the moment. Yeah, 100% with you. And why is it, you think, traditional point in time access reviews, why are they struggling in an environment where identities, integrations and machine access are constantly changing? What are you seeing here? That's a great question, Neil.

[00:15:49] And so point in time, you know, typically organizations would go through a user access review or a certification on a sort of twice a year basis. Right. But there's a lot of things can happen between that, those particular reviews. Right. You have a long period of time where entitlements can be assigned to users that shouldn't have.

[00:16:13] And, you know, events can occur and the risks, the risk is much higher the longer those entitlements or incorrect entitlements have been assigned.

[00:16:23] And so I think that, given the fact that the scope of the operations that we're all and the systems that we all have to manage has grown so much that ensuring that you have a solution in place that can go through and check these certifications on a more automated basis is essential. I think before and still a lot of organizations are doing this manually. You can imagine.

[00:16:52] They're pulling spreadsheets of users and role assignments. They're trying to upload that into some master spreadsheet, which they send around to reviews. I've seen a lot of these types of this process, user access reviews, kind of partially automated. But, you know, there are solutions out there that can do this, you know, fully automatically.

[00:17:15] And one of the key things I think with AI that's becoming critical is if there is something, if you're monitoring your system and you do find some kind of anomaly, you want to have a point in time review. You want to be able to initiate that process right away and say, hey, this user has access that's maybe not consistent with others on his team. You know, do we need it? Do we need to remove it? And has anything anomalous been executed?

[00:17:44] And if so, we better take a look at that. And I think more so this year, I've been seeing customers that are challenged with lookbacks. And for those of you that aren't familiar with lookbacks, lookback is when you've had a user access review and you found an anomalous transaction, something a user shouldn't have. Did they execute that? Did they create a PO? Did they, you know, manage a vendor?

[00:18:10] Did they, you know, change their address since they had that particular assignment maybe months ago? Or somebody left the company and they still have access. Were those transactions executed? And often to do that, it's a massive manual ask to have someone go pull data manually from a system into a spreadsheet to review it.

[00:18:32] So those are two critical reasons that organizations are dealing with now with respect to point-in-time access and ensuring that, you know, they have a system in place to govern that access and check to make sure that no anomalous activity has been assigned.

[00:18:54] I mean, real true point-in-time access with, you know, dynamic authorization where there's a system that just evaluates, you know, whether you're granted the role or not, I think is, I mean, theoretically possible, but very, very seldomly implemented in any form or fashion out there. With the current business application environments that we're all in today.

[00:19:17] And everything we're talking about here is something that will be impacting every business in every industry of every size. So what does continuous access monitoring look like in practice right now, realistically? And how can teams avoid creating just another dashboard that nobody has time to watch because they're suffering from alert fatigue from all the others? That's a great question, Neil.

[00:19:42] And I would say that continuous monitoring involves looking at and getting a signature on the transactional data and characteristics that are going on. And I think you want to try to have an understanding of what activity is going on and being able to kind of get a signature on what that looks like so you can identify any kind of anomalous transactions.

[00:20:07] I mean, there's controls in place to make sure that you kind of got guardrails on your process. You know, I mean, spending levels and limits and volumes of transactions. You know, you have this sort of metadata that you're looking at. And then, you know, increasingly, you know, what Pathlock has done is done deep integrations with 150 plus business applications.

[00:20:32] And when I say deep integrations, it's been able to do fine grained user provisioning and integrate with the activity and transactional logs that these applications are creating. And I think when you have those two sides of the coin, you can really do a deep, deep understanding of the activity through that, through the, through the data that you're collecting.

[00:20:55] And once you have that data, I think data is data is king kind of, and you can run all kinds of run all kinds of AI on it to make sure that everything's functioning as it should. Yeah. Yeah. And, you know, so much has changed, but obviously this is not your first rodeo, Chris, as you said at the very beginning, 17 years at SAP.

[00:21:19] So what have you learned about that gap between how ERPs control controls are designed and how they operate in the real world? So, um, so controls for everyone out there, uh, you know, control can be anything. Yeah. Um, control can be, Hey, we, you know, we need to achieve the revenue objective this quarter. That's a control. And so a control is just a list of objectives really, and requirements.

[00:21:47] And those can be implemented in various different ways. Some systems have configurations that enforce the control, don't allow that control to be performed. Um, and other times you have to go back and maybe perform more manual tasks. And I think, um, you know, in today's environment, you have a fairly mature set of controls that are available for each of the types of regulations and security regulations.

[00:22:13] You'll probably hear the term ITGCs, IT general controls, um, SOX controls. You know, uh, we talk a lot about SOX controls because these are the controls that go into your, your finance process. And so you have different tools in your set of, um, different tools you can, you can use to validate that your controls are effective. And that's a key thing. I mean, that's like a, a loaded term controls, controls, uh, effectiveness.

[00:22:42] Oh, if we've had a failure of controls, that is a meaningful event that occurs. And one of the things that I've become fascinated with is, is, um, is talking to people that ever have experienced these kinds of things behind the scenes. It's very revealing and it's not very fun to have, um, a controls failure or have some kind of audit finding or, you know, a material weakness is when you have to report a finding in your, your 10 Q, your quarterly reporting.

[00:23:13] And what happens when you have a material weakness is often the case where, and your, your, your, uh, your listeners will know this, right? If you have a material weakness, it reflects badly on the company. It shows something isn't being well managed and that affects your brand. It can affect your stock price. You know, the value of your, of your company. It's, it can be profound, but the impacts can be billions of dollars. Right.

[00:23:38] And so, I mean, ultimately, yeah, ultimately we are trying to implement the controls that demonstrate our company is managed properly. Uh, so that we don't have any kind of anomalous findings, um, during, from our auditors that would result in anything that we'd ever have to report to, uh, report on our 10 Q paperwork.

[00:24:00] You mentioned that something that really resonated as well, because when things go wrong and that inevitable P1 incident drops, technical teams can feel almost like that Spider-Man meme with each member pointing at each other. So when something like that happens, where should responsibility sit across when we're talking about security teams, audit compliance and transformation teams? And that, so access governance doesn't become everyone's problem and nobody's priority. We've all been in those situations, right? Jeez.

[00:24:28] Neil, you've set me up for a softball question because it's a topic I'm fascinated by, you know? And, um, I was at a conference and I asked that question. I said, what do you guys do when something, do things go wrong? You know, and, and what happens when things go wrong? And, um, you can imagine, I mean, this really, really great customer, um, uh, he's telling me and he started, he started telling me that sometimes the systems don't breathe. And I said, well, what do you mean the systems don't breathe?

[00:24:58] And he was flapping his arms, you know, like, um, like a bird, like a chicken, you know? I wasn't sure it was a language difference there, but he, he said, sometimes the system freezes. And I was like, oh, okay. Everybody's experienced their computer freezing, you know? And what do you do? You reboot it. And, well, okay. So if this computer is running your ERP system, it's managing a giant supply chain, it triggers all, it triggers a process.

[00:25:27] And that process involves, and it happens within 10 minutes. And so that process involves, uh, letting, letting the, you know, the, the, the C-suite know that there's been an incident. They, they bring in, you know, IT experts to try to, to diagnose the problem. And I mean, it is, it is a really big deal. Like you, you could have thousands of people, you know, waiting to screw nuts on, you know, with the chassis or, you know, um, you know, install the engine and so forth.

[00:25:55] You have a supply chain, um, and an assembly process that's waiting for the system to come back up. And ultimately in those cases, um, and there are very few, very rare, but they go in and they may spend two or three hours trying to diagnose the, the, the channel. Why is the system freezing? And you're turning off processes, turning on processes. We've all been in our computers trying to do that. And then ultimately, if they can't determine the problem, they'll reboot the system. I was completely amazed.

[00:26:24] So there's, there's two, there's two sides of the equation. So there's really critical and urgent events and there's an entire process. And there's a communication chain that is, that is created just for this. These are critical and urgent events that have to be dealt with immediately. They're impacting your business. Uh, your entire organization is aligned to make, prioritize whatever activities to get that system up and running.

[00:26:48] And then there are other cases where maybe you've got, um, maybe you've got a case where your incoming POs aren't matching. You've got some configuration change in your system. The incoming POs aren't matching requisitions or what have you. So you've got to go through and make a bunch of different configuration changes. It's a, it's a very different kind of urgent, uh, emergency access scenario. Both of them can have certain kinds of effects, but system freezing rebooting. I'd never heard that before.

[00:27:17] Um, and, uh, I completely fascinated. It's always completely amazing, um, to talk to our customers that, that, that, that are operating these businesses at such huge scale. And, um, you know, there's, it's always interesting things you hear, even though you're, you may be talking to an internal controls team. They know the ins and outs of the business. They know what's going on. And I had another, I had conversation the other day with an organization.

[00:27:42] They're like, they refined crude oil into its various different products. And they've got literally like super tankers coming in on a, you know, like two or three a week come in. Yeah. With half a million barrels of oil. You know, I just love, I love thinking about the scale of these operations. And even though, even though you're on the internal controls team, you can have a profound effect. Absolutely. Love it.

[00:28:10] And finally, just to give everyone listening a valuable takeaway, if they're in a organization that is about to begin a major ERP or AI transformation, that's why they're listening today. Any tips on what controls they should be designing in right from day one, rather than trying to bolt on after go live? Um, great question, Neil. So, yeah. So at Pathlock, you know, we focus on application access governance and controls associated with that.

[00:28:36] And so, you know, your Sarbanes-Oxley controls include, you know, um, you know, segregation of duties controls, um, being able to manage urgent and, um, you know, firefighting or emergency access scenarios. Ensuring that, uh, users have the right entitlements that are aligned with the business process that they're, that they're, um, they're involved with.

[00:28:59] And so any of the controls, ITGCs, um, SOX controls, definitely anything having to do, uh, with access governance is critical to consider in your, your S4 HANA transformation. Because when you move from, you know, ECC to S4, the, the structure of the entitlements in the S4 system is different. You have, you have Fiori, Fiori tiles, and there's a lot of changes in, in the underlying transactions themselves. Some of them don't exist.

[00:29:28] So if you're relying on a particular transaction in your controls, uh, your compliance reporting, that, that transaction may not exist anymore. So it's important to consider the role design, um, um, um, the process by which you assign and manage, um, user access, um, the processes by which you, uh, certify that user, those user accesses periodically, um, you know, emergency access. Uh, for sure.

[00:29:57] Um, all upfront in the design process, because the last thing you want is when, when you go live to have some kind of issue, some kind of finding, um, that will be a little bit more. Will affect, um, your, your company's value or could potentially impact, um, your supply chain in some way. And so you need to make sure that user access and your role structures, your governance processes are all in place, um, very early in the program.

[00:30:22] You want to leverage access governance processes to manage team members who are involved in the S4 transformation team. Um, because the last thing you want there is to have a developer, you know, having access, you know, to, to a, uh, a powerful role in a live system. You know, you want to, you don't want to go live with that kind of, uh, this kind of entitlements in place. And so access governance really plays a critical role. And one of the main things is ensuring that you don't have an issue.

[00:30:52] You don't have a segregation of duties issue. You don't, you don't create a situation that could impact your, impact your, uh, your, your controls, um, um, effectiveness. And that could result in some kind of material weakness or finding later on. The challenge we see Neil though, is that for organizations that have already started, you know, their, their focus is going live. Everything is all, all hands on deck.

[00:31:20] There's a lot of money being spent on the, on the transformation itself. It's like, you know, we're just going to, we can't delay it one day. Um, if possible, we're not going to take on any additional efforts. And so that's a challenge you have in your organization. To fight, to fight the, Hey, there could be a risk of, uh, an event after a lot, after we go live, unless we take care of this now versus. Hey, we're spending a lot of money on this. We're going live no matter what.

[00:31:48] Um, we've got to get these, um, expensive consultants off the, off, off the payroll. And I think that is a powerful moment to end on. And for anyone listening, they're not on, you don't have to be on your own on this journey. And obviously we've covered a lot in a short amount of time, but for anyone that wants to continue this conversation with you, your team, find out more about how you might be able to help at Pathlock. Where should they be going? Um, definitely reach out, check us out at www.pathlock.com.

[00:32:17] Um, my email address is chris.radkowski at pathlock.com. I'm also chrisradkowski on LinkedIn. So reach out, um, let us know your stories and, uh, we love hearing about it and we'd love to help you with your access governance, uh, and compliance challenges. Hey, uh, so thanks so much, Neil. No, thank you. I will include links to everything there. Well, to the website and to your LinkedIn page for sure.

[00:32:44] I'll encourage people to check that out and please feedback to me. Let me know what your, um, what's working, what isn't everything in between. I love to keep this conversation going, but thank you for starting it today. Really appreciate you, Tom. Great. Thank you. I think Chris's examples bring access governance right back to the business processes that it supports.

[00:33:05] When an ERP system cannot perform its job, the consequences can reach the factory gate, the supply chain and financial reporting. And I really appreciate that distinction between having a permission and using it. And understanding both, I think helps teams decide what access remains appropriate and what activity deserves further investigation, especially when agents and integrations are involved.

[00:33:33] And the takeaway for myself is address role design, access reviews and emergency access while planning a transformation. Because leaving those decisions until after go-live can make them harder to resolve when the pressure is on to keep operations running. And we all know that that stuff will blindside you, usually on a Friday afternoon. I don't know why it is always a Friday afternoon, but it usually is.

[00:33:59] So a big thank you to Chris from Pathlock for joining me here on Tech Talks Daily. You'll find his contact details, company resources, etc. in the episode notes over at techtalksnetwork.com. But over to you, where are access controls creating uncertainty in your organisation? What would you change before your next transformation?

[00:34:23] What does your identity access management look like when we're talking about adding teams of agents into the mix too? Let me know your thoughts by sending me a quick audio message at techtalksnetwork.com. Everything you need should be over there, so give me a shout. But I have taken up far too much of your time, so time for me to go now. I'll be back again tomorrow. Thanks again. Bye for now.