Continuous Trust Scoring for Cross-Layer Access Governance in S/4HANA, Fiori, and SAP BTP
DOI:
https://doi.org/10.15662/IJEETR.2022.0401007Keywords:
Continuous Trust Scoring, Zero Trust Architecture, SAP S/4HANA, SAP Fiori, SAP Business Technology Platform, Identity and Access Management, User and Entity Behavior Analytics, Graph Analytics, Segregation of Duties, Continuous Compliance Monitoring, Adaptive Access GovernanceAbstract
Modern SAP landscapes span multiple technology layers including SAP S/4HANA, SAP Fiori, SAP Business Technology Platform (BTP), cloud identity services, and external enterprise applications. Traditional role-based access control approaches provide limited visibility into evolving access risks across these interconnected environments. This paper proposes a Continuous Trust Scoring framework that dynamically evaluates enterprise access risk using behavioral analytics and cross-platform identity intelligence. The proposed architecture continuously analyzes authentication events, authorization changes, user behavior patterns, application context, segregation-of-duty policies, and cloud identity relationships to generate adaptive trust scores for individual users, service accounts, and business processes. Machine learning algorithms identify anomalous access behavior while graph analytics detect privilege escalation pathways across enterprise systems. The framework supports automated policy enforcement, continuous compliance monitoring, and proactive access governance without relying solely on periodic audit activities. A simulation-based evaluation illustrates improved detection of access anomalies, reduced governance overhead, and enhanced enterprise security posture across hybrid SAP landscapes. The Continuous Trust Scoring model establishes an adaptive governance architecture capable of supporting Zero Trust security principles within complex cloud-enabled ERP ecosystems
References
1. Ahmed, M., Mahmood, A. N., & Hu, J. (2016). A survey of network anomaly detection techniques. Journal of Network and Computer Applications, 60, 19 to 31.
2. Akoglu, L., Tong, H., & Koutra, D. (2015). graph-based anomaly detection and description: A survey. Data Mining and Knowledge Discovery, 29(3), 626 to 688.
3. Alles, M. G., Kogan, A., & Vasarhelyi, M. A. (2008). Putting continuous auditing theory into practice: Lessons from two pilot implementations. Journal of Information Systems, 22(2), 195 to 214.
4. Anderson, J. P. (1980). Computer security threat monitoring and surveillance. James P. Anderson Co.
5. Botha, R. A., & Eloff, J. H. P. (2001). Separation of duties for access control enforcement in workflow environments. IBM Systems Journal, 40(3), 666 to 682.
6. Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153 to 1176.
7. Chan, D. Y., & Vasarhelyi, M. A. (2011). Innovation and practice of continuous auditing. International Journal of Accounting Information Systems, 12(2), 152 to 160.
8. Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly detection: A survey. ACM Computing Surveys, 41(3), Article 15.
9. Denning, D. E. (1987). An intrusion-detection model. IEEE Transactions on Software Engineering, SE-13(2), 222 to 232.
10. Eberle, W., & Holder, L. (2009). Anomaly detection in data represented as graphs. Intelligent Data Analysis, 13(4), 663 to 689.
11. Ferraiolo, D. F., Sandhu, R., Gavrila, S., Kuhn, D. R., & Chandramouli, R. (2001). Proposed NIST standard for role-based access control. ACM Transactions on Information and System Security, 4(3), 224 to 274.
12. Garbis, J., & Chapman, J. W. (2021). Zero trust security: An enterprise guide. Apress.
13. Homer, J., Zhang, S., Ou, X., Schmidt, D., Du, Y., Rajagopalan, S. R., & Singhal, A. (2013). Aggregating vulnerability metrics in enterprise networks using attack graphs. Journal of Computer Security, 21(4), 561 to 597.
14. Hu, V. C., Ferraiolo, D. F., Chandramouli, R., & Kuhn, D. R. (2017). Attribute-based access control. Artech House.
15. Hu, V. C., Ferraiolo, D., Kuhn, R., Schnitzer, A., Sandlin, K., Miller, R., & Scarfone, K. (2014). Guide to attribute based access control (ABAC) definition and considerations (NIST Special Publication 800-162). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-162
16. Indu, I., Anand, P. M. R., & Bhaskar, V. (2018). Identity and access management in cloud environment: Mechanisms and challenges. Engineering Science and Technology, an International Journal, 21(4), 574 to 588.
17. Kerman, A., Borchert, O., Rose, S., & Tan, A. (2020). Implementing a zero trust architecture (Project description). National Cybersecurity Center of Excellence, National Institute of Standards and Technology.
18. Kindervag, J. (2010). No more chewy centers: Introducing the zero trust model of information security. Forrester Research.
19. Kuhn, D. R., Coyne, E. J., & Weil, T. R. (2010). Adding attributes to role-based access control. IEEE Computer, 43(6), 79 to 81.
20. Little, A. G., & Best, P. J. (2003). A framework for separation of duties in an SAP R/3 environment. Managerial Auditing Journal, 18(5), 419 to 430.
21. Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008). Isolation forest. In Proceedings of the 2008 Eighth IEEE International Conference on Data Mining (pp. 413 to 422). IEEE.
22. Lunt, T. F. (1993). A survey of intrusion detection techniques. Computers & Security, 12(4), 405 to 418.
23. Molloy, I., Chen, H., Li, T., Wang, Q., Li, N., Bertino, E., Calo, S., & Lobo, J. (2010). Mining roles with multiple objectives. ACM Transactions on Information and System Security, 13(4), Article 36.
24. Noble, C. C., & Cook, D. J. (2003). Graph-based anomaly detection. In Proceedings of the Ninth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (pp. 631 to 636). ACM.
25. Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207
26. Sakurada, M., & Yairi, T. (2014). Anomaly detection using autoencoders with nonlinear dimensionality reduction. In Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis (pp. 4 to 11). ACM.
27. Sandhu, R. S., Coyne, E. J., Feinstein, H. L., & Youman, C. E. (1996). Role-based access control models. IEEE Computer, 29(2), 38 to 47.
28. SAP SE. (2020). Security guide for SAP S/4HANA 2020. SAP Help Portal.
29. SAP SE. (2021). Security administration: Managing authentication and authorization of the SAP Business Technology Platform. SAP Help Portal.
30. SAP SE. (2021). Security guide for SAP S/4HANA 2021. SAP Help Portal.
31. SAP SE. (2022). Security guide for SAP S/4HANA 2022. SAP Help Portal.
32. Shashanka, M., Shen, M.-Y., & Wang, J. (2016). User and entity behavior analytics for enterprise security. In 2016 IEEE International Conference on Big Data (Big Data) (pp. 1867 to 1874). IEEE.
33. Simon, R. T., & Zurko, M. E. (1997). Separation of duty in role-based environments. In Proceedings of the 10th Computer Security Foundations Workshop (pp. 183 to 194). IEEE.
34. Sommer, R., & Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE Symposium on Security and Privacy (pp. 305 to 316). IEEE.
35. Vaidya, J., Atluri, V., & Guo, Q. (2007). The role mining problem: Finding a minimal descriptive set of roles. In Proceedings of the 12th ACM Symposium on Access Control Models and Technologies (pp. 175 to 184). ACM.
36. Vasarhelyi, M. A., & Halper, F. B. (1991). The continuous audit of online systems. Auditing: A Journal of Practice & Theory, 10(1), 110 to 125.
37. Xu, Z., & Stoller, S. D. (2015). Mining attribute-based access control policies. IEEE Transactions on Dependable and Secure Computing, 12(5), 533 to 545.
