Sensitive data is inherent to SAP solutions. Data must be protected against external unauthorized access, thus meaning extensive security and protection monitoring is required.
Because SAP Systems have a holistic management approach to a company, the data we must monitor is far-reaching. Within SAP security, there are different considerations such as network security, database security, operating system security, infrastructure security, and many more.
The purpose of SAP security is to ensure data integrity, avoid but quickly detect data leaks, mitigate fraud, and to centralise security monitoring. Outsourcing your SAP S/4HANA system configuration and setup can help make your solutions watertight and improve security. However, you mustn’t rely on outsourcing ongoing security solely, and should clear up the roles of security within your own team.
It’s important to assign roles and authorisations appropriately and to stay on top of this. Examining authorisations is crucial to preventing unauthorised access, which can be done using a test catalog.
Transaction monitoring
SAP systems can be accessed remotely and have a lot of critical transactions. Using APIs, functional modules can be accessed remotely, and thus authorisation once again becomes a crucial point to avoid manipulation of data within the SAP system.
System settings
SAP systems will usually have a lot of native settings. These are important to be configured correctly at the database level by SAP Profile Parameters (stored as files). Outsourcing this configuration can help ensure an SAP system rollout that complies with a set of rules found in an SAP Basis operating manual.
It’s important to know how the security settings are assigned, what type of communications are allowed, and how access is denied and granted.
Best practices
It’s important to uphold best practices, of which there are many with SAP systems. A basic checklist can be created, to ensure you complete assessments such as:
- OS security assessment
- Internal assessment of access control
- DBMS security assessment
- Assessment of compliance
It’s important to create emergency procedures in the event of a breach or other type of emergency. These can plan the response you will have, such as being able to revoke access and privileges quickly as seen appropriate.
Monitoring your SAP systems should be ongoing with the list of permissions being regularly updated. This is even more important when staff turnover is high, new employees are brought in, and roles are being changed (i.e. internal hiring). The right security tools should be implemented to detect suspicious activity, too, which can help stamp out a cyberattack more quickly.
Code security
Code security is an important part of SAP security. It’s usually the developers that are in charge of the ABAP code security, which should cover everything from the production systems to the development systems.
Transports become important when considering the possibility of attackers injecting code, given that coding can be created and executed at runtime. SAP offers code inspecting modules, like Code Vulnerability Analyzer, which can help monitor the coding. Coding is at the core of SAP systems, so it’s vital to enable custom the appropriate code scanners to automate this monitoring.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
