UI Data Protection – How to protect sensitive data displayed in Analytical Queries using SAP Analytics Cloud

Introduction

In this blog, we will learn how to configure masking in Analytical Queries to protect the sensitive information displayed in SAP Analytics Cloud Story. Analytical Queries are used for reporting and analysis.

S/4HANA Embedded Analytics

Analytics is one of the most typical and tangible value of S/4HANA. S/4HANA Embedded Analytics is the function for real-time operational analytics in S/4HANA. It consists of ABAP CDS Views as data source and Fiori Analytical application as the frontend. As the frontend, other than S/4HANA Embedded Analytics, SAP Analytics Cloud is available which is used together with S/4HANA embedded analytics.

SAP Analytics Cloud

SAP Analytics Cloud is an end-to-end cloud solution that brings together business intelligence and enterprise planning, augmented with the power of artificial intelligence, machine learning technology, and predictive analytics in a single system.

The main benefits of SAP Analytics Cloud include ease of viewing content, connectivity to trusted data, access to various visualization tools, augmented analytic capabilities, and financial planning features. In a single cloud system one can analyze, ask, predict, plan, and report.

Stories are main part of SAP Analytics to explore data and to find deep insight using charts and tables. An SAP Analytics Cloud Story is a presentation-style document that uses charts, visualizations, text, images, and pictograms to describe data.

Here, we will use Story to showcase masking of sensitive fields of analytical queries in SAP Analytics Cloud. We will configure masking through Manage Sensitive Attributes app provided by UI Data Protection Masking for SAP S/4HANA 2011 solution based on Role Based Authorization Control (RBAC) concept.

Manage Sensitive Attributes app

The Manage Sensitive Attributes application allows you to maintain configuration for UI data protection in an SAP Fiori-based UI.

This application brings together several individual transactions, simplifying the maintenance of masking configuration and presenting a holistic picture to the end user. With this app, you can:

• Create, update, and delete sensitive attributes
• Define masking and blocking configurations
• Manage technical attribute mappings
• Create and assign context attributes
• Create and assign derived attributes and lists of values

You can use the app on your desktop, tablet, or smartphone.

Prerequisite

UI data protection masking for SAP S/4HANA is a solution for selective masking of sensitive data on SAP S/4HANA user interfaces – SAP GUI, SAPUI5/SAP Fiori, Web Dynpro for ABAP, and Web Client UI. Data can be protected at field level, either by masking the content (replacing original characters with generic characters, such as asterisks) or by clearing or disabling the field.

Requirement

Here, we want to configure masking for Journal Entry field in Aging grid of journal entry view of Accounts Receivables story using Role-based authorization concept. Product “UI data protection masking for SAP S/4HANA 2011” is used in this scenario to protect sensitive data at field level and must be installed in the S/4HANA system.

Note: Currently, Masking in Analytical Queries can be configured based on Role-based authorization concept only.

Let’s begin

Configuration to achieve masking Journal Entry field

Login to Fiori Launchpad and click on “Manage Sensitive Attributes” app available under “UI data protection masking” catalog.

Maintain Sensitive Attributes

A Sensitive Attribute is a type of logical attribute that define a field which needs to be configured for UI data protection.

• Click on Add icon

• Enter “LA_EA_JOURNAL_ENTRY” in Sensitive Attribute field
• Enter “EA Journal Entry” in Description field
• Click on “Create” button

• Sensitive Attribute with specified details will be created.

Maintain Mapping to Technical Addresses

In the Manage Sensitive Attributes application, you can link technical addresses of fields to sensitive attributes. A technical address describes the exact technical path or technical information which is used by the solution to process the field for UI data protection masking.

Note: To retrieve the Technical Address for Analytical Query fields, you need to use Recording Tool feature to get the Technical Address as Technical Information on press of F1 key is not available here. Refer the Blog to know how to use Recording Tool.

Under Technical Mapping > Analytics, choose the Add icon.

Use the value help to select the InfoProvider, Query, and InfoObject information. You can also enter the referenced query name as a comment to describe the mapping.

Masking Configuration

In the Manage Sensitive Attributes application, you can configure masking for a sensitive attribute to define in detail how it is to be protected in the system. Masking configuration defines which fields are to be masked for unauthorized users and in which contexts.

To configure masking for a sensitive attribute, under Configuration > Masking Configuration, choose Edit.

• Enable masking.
• Select Role-Based authorization concept. For role-based authorization, use the value help to select a PFCG role
• Select a field-level action to determine what should be visible to unauthorized users. Users with this PFCG role will have access to the original values.
• Save the configuration.

Masking in SAP Analytics Cloud Story

• Login to SAP Analytics Cloud and Click on Stories menu option

• Click on “Aging Grid of journal entry view of Accounts Receivables” Story

• Journal Entry field value will appear as masked

Conclusion

In this blog post, we have learnt how Role-based masking is achieved in Analytical Queries in SAP Analytics Cloud for masking sensitive field information.