1. Integrated Security Solutions © 2006 TK Consulting, LP realtime Confidential March 11, 2007 APM Demo

2. © 2006 realtime North America, Inc. 2realtime ConfidentialAugust 29, 2015 Contents Overview APM Role Management APM Risk Management Q & A

3. © 2006 realtime North America, Inc. 3realtime ConfidentialAugust 29, 2015 Who We Are - realtime SAP ISV & IVN Partner NetWeaver Certified Biometric Identity Management Risk & Role Management 200 Global Fortune Clients Established in 1986

4. © 2006 realtime North America, Inc. 4realtime ConfidentialAugust 29, 2015 SAP Security Solutions mySAP Security Solutions Four-Tier balance APM bioLock Cost Compliance Usability

5. © 2006 realtime North America, Inc. 5realtime ConfidentialAugust 29, 2015 APM Overview Authorization Profile Management Developed by realtime in 1997. Complete solution for SAP role management, audit assessment and Sarbanes-Oxley compliance. Pre-delivered with Risk and Process Analysis cases. Installed at over 150 Fortune 500 and other companies such as Marathon Oil, US Army, Merck AG, Schwarz- Pharma AG, Siemens and Toyota.

6. © 2006 realtime North America, Inc. 6realtime ConfidentialAugust 29, 2015 Contents Overview APM Role Management APM Risk Management Q & A

7. © 2006 realtime North America, Inc. 7realtime ConfidentialAugust 29, 2015 APM Role Management Role Management Collaborate with Business to identify authorization for Role Generation via Authorization Trace Customizable Derived Role reduces maintenance cost by reducing the number of roles Mass Change function reduces administration cost Accelerate implementation

8. © 2006 realtime North America, Inc. 8realtime ConfidentialAugust 29, 2015 APM Role Management Authorization Trace Benefits Defined from the SAP point of view in cooperation with the Business. No need to learn how SAP-System trace is handled. Easily troubleshoot and resolve authorization issues. The logged authorizations represent the minimum specifications. Retrieves to workspace for role generation or add to existing role.

9. © 2006 realtime North America, Inc. 9realtime ConfidentialAugust 29, 2015 APM – Authorization Trace Set Traces against one or more Users

10. © 2006 realtime North America, Inc. 10realtime ConfidentialAugust 29, 2015 APM – Authorization Trace Traced data are imported into APM for analysis and Role Generation

11. © 2006 realtime North America, Inc. 11realtime ConfidentialAugust 29, 2015 APM – Role Management Customizable Derived Role Benefits Builds flexible and customizable roles inherited from a Master template Reduces maintenance cost

12. © 2006 realtime North America, Inc. 12realtime ConfidentialAugust 29, 2015 SAP – Profile Generator Derived Role Only Org. Data can be modified!

13. © 2006 realtime North America, Inc. 13realtime ConfidentialAugust 29, 2015 APM – Customize Derived Role Organizational and Inherited Authorization can be modified

14. © 2006 realtime North America, Inc. 14realtime ConfidentialAugust 29, 2015 Contents Overview APM Functionalities Discussion APM Role Management APM Risk Management Q & A

15. © 2006 realtime North America, Inc. 15realtime ConfidentialAugust 29, 2015 APM – Risk Management Risk Management Overview Identifies Sensitive Access (SA) and Segregation of Duties (SoD) Defines SA & SoD at Transaction and/or Authorization Field Value Proactive Risk Analysis Inactivates pre-defined authorization Performs user provisioning Risk Simulation Real-time Reporting and Monitoring

16. © 2006 realtime North America, Inc. 16realtime ConfidentialAugust 29, 2015 APM – SA & SoD Definition Document additional Risk Description Email changes to Risk Owner Document Mitigating Controls and Exceptions

17. © 2006 realtime North America, Inc. 17realtime ConfidentialAugust 29, 2015 APM – Risk Management Proactive Assessment Inactivate pre-defined risk Flags critical authorization

18. © 2006 realtime North America, Inc. 18realtime ConfidentialAugust 29, 2015 APM – Risk Management Reporting 3-Level Simulations Single Roles Profiles Transactions

19. © 2006 realtime North America, Inc. 19realtime ConfidentialAugust 29, 2015 APM – Risk Management Reporting Realtime Process Analysis Detailed User, Role, and Auth. Value Cross Clients/Systems

20. © 2006 realtime North America, Inc. 20realtime ConfidentialAugust 29, 2015 APM – Risk Management Reporting ALV Reporting View

21. © 2006 realtime North America, Inc. 21realtime ConfidentialAugust 29, 2015 APM – Risk Management Reporting 3 Levels of Reporting View

22. © 2006 realtime North America, Inc. 22realtime ConfidentialAugust 29, 2015 APM – Risk Management Monitoring – Supervisor may periodically review, approve, disapprove, and document

23. © 2006 realtime North America, Inc. 23realtime ConfidentialAugust 29, 2015 APM – Risk Management Approval History

24. © 2006 realtime North America, Inc. 24realtime ConfidentialAugust 29, 2015 APM – Risk Management Risk Change Management History

25. © 2006 realtime North America, Inc. 25realtime ConfidentialAugust 29, 2015 APM – Special User Monitors executed Programs & Transactions

26. © 2006 realtime North America, Inc. 26realtime ConfidentialAugust 29, 2015 Questions