Security Overview
SAP Solution Security Overview
To get an overview on the status of the security of your SAP solution, the recommended first steps are:
- Have a look at the Security chapter of the EarlyWatch Alert (EWA) report of your key systems and analyze the root cause of the findings. SAP Note 863362 describes the security checks in the EWA.
- Consider additional tools like the Security Optimization Service, System Recommendations or Change Diagnostics and Configuration Validation.
- SAP Note 2253549 describes how-to use our SAP Security Baseline as a starting point to define a corporate security baseline specific to your environment based on SAP recommendations.
- As a MaxAttention or ActiveEmbedded Customer: Go for a SAP Security Engagement which will provide you with an expert guided analysis and approach for your SAP landscape.
- As an Enterprise Support Customer: Make use of the SAP Enterprise Support Value Map for Security.
More information on our tools, services and recommendations can be found in our SAP CoE Security Services Master Slide Decks:
Getting an overview on the Secure Operations Map
The Secure Operations Map structures the overall topic of secure operations into 5 areas, further broken down into 16 tracks. Each of these tracks gives an overview on the respective topic and on key activities important for secure operations.
The tracks of the Secure Operations Map cover the following topics:
Security Compliance
- Security Governance: Adopt security policies for your SAP landscape, create and implement an SAP Security Baseline
- Audit: Ensure and verify the compliance of a company’s IT infrastructure and operation with internal and external guidelines
- Cloud Security: Ensure secure operation in cloud and outsourcing scenarios
- Emergency Concept: Prepare for and react to emergency situations
Secure Operation
- Users and Authorizations: Manage IT users and authorizations including special users like administrators
- Authentication and Single Sign-On: Authenticate users properly – but only as often as really required
- Support Security: Resolve software incidents in a secure manner
- Security Review and Monitoring: Review and monitor the security of your SAP systems on a regular basis
Secure Setup
- Secure Configuration: Establish and maintain a secure configuration of standard and custom business applications
- Communication Security: Utilize communication security measures available in your SAP software
- Data Security: Secure critical data beyond pure authorization protection
Secure Code
- Security Maintenance of SAP Code: Establish an effective process to maintain the security of SAP delivered code
- Custom Code Security: Develop secure custom code and maintain the security of it
Infrastructure Security
- Network Security: Ensure a secure network environment covering SAP requirements
- Operating System and Database Security: Cover SAP requirements towards the OS and DB level
- Frontend Security: Establish proper security on the frontend including workstations and mobile devices
The goal of this Secure Operations Map is not to try to replace the wealth of security related information from SAP but to provide an overview and guides through all this information by referencing to more detailed information, e.g. from the SAP Help Portal, the SAP Support Portal, the SAP Community Network or SAP Notes whenever possible.
The goal of the SAP Secure Operations Map is to introduce the reader to activities being important for the secure operation of SAP solutions. The focus on activities (instead of technologies) shall help to pragmatically answer questions like "I am in charge of operations ... what shall I do to manage security?”
SAP Security Engagement and Security in the Enterprise Support Academy
A SAP Security Engagement is a joint approach of SAP Active Global Support with a customer over a period of several months to improve and increase the security of the customers SAP landscape with focus on the most relevant security topic areas in the specific situation. It is an offering especially available to MaxAttention, Safeguarding and ActiveEmbedded customers.
Such a SAP Security Engagement typically starts with a Security Workshop to discuss the topic areas to be tackled during the engagement. During a subsequent engagement period SAP accompanies the customer to ensure that not only the Security Workshop delivered good results but during the engagement period also provable positive impact to the security of the customers SAP landscape gets achieved. Finally a Security Verification Workshop wraps-up the results of the engagement phase, verifies the achieved security impact and summarizes recommended next steps for the time after this SAP Security Engagement.
For Enterprise Support customers a lot of information and services including several Expert Guided Implementation Sessions (EGI) is available in our Enterprise Support Academy and our SAP Enterprise Support Value Map for Security.
Security Services, Tools and Information
Best practices-based security services
SAP enables its customers to protect their business processes through a comprehensive security portfolio turned into services. We take the security chapter of the EarlyWatch Alert as a starting point to offer detailed services mainly around the Security Optimization Service ant the Security Notes which are published on SAP Support Portal and shown in the application System Recommendations of the SAP Solution Manager.
Combining the results of these services with the existing Security Policy of the company we define the company’s SAP Security Baseline. This document is then used do define Target Systems for the application Configuration Validation in the SAP Solution Manager. You can either use the cross-system BW reports of that application directly or you can pass results to another reporting infrastructure like a Management Dashboard within the SAP Solution Manager, to Business Objects, to GRC Process Control or any other reporting system.
References
Among others, following sources are used within the security services:
SAP Note 863362 - EarlyWatch Alert (EWA) report - Security chapter
SIS264 Securing Remote Access within SAP NetWeaver AS ABAP
Protecting SAP Applications Against Common Attacks
Secure Configuration SAP NetWeaver Application Server ABAP
SAP Security Recommendations: Securing Remote Function Calls (RFC)
Governance, Risk, and Compliance — Access Control