Cybersecurity for SAP
Protect your SAP system from bad actors! Start by getting a thorough grounding in the why and what of cybersecurity before diving into the how. Create your security roadmap using tools like SAP’s secure operations map and the NIST Cybersecurity Framework (CSF). Then walk through key cybersecurity processes: vulnerability management, threat detection, incident response, disaster recovery, and more. With step-by-step instructions for implementing infrastructure and network security and using tools like SAP Trust Center, this guide will help you safeguard your system!
- Use the NIST Cybersecurity Framework to design your cybersecurity program
- Implement vulnerability management, threat detection, network security, and other techniques in your SAP system
- Map SAP cybersecurity functions to frameworks, standards, and regulatory requirements for compliance
You'll learn about:
- Getting Started:
Walk through cybersecurity principles, concepts, and frameworks in the context of your SAP system. Learn why your baseline SAP landscape needs additional cybersecurity protection and which tools can be used to defend which parts.
- Implementing Cybersecurity:
Establish robust cybersecurity practices in your SAP landscape! Build a review process for patch day, detect anomalies, create a backup strategy, assess the impact of the cloud on your security protocols, and much, much more.
- Frameworks and Tools:
Discover how to map SAP security functions to standard frameworks like NIST, ISO, and CIS. Explore tools for securing your landscape, such as SAP Trust Center, and discover the RISE with SAP shared responsibility model.
Key Highlights:
- Security architecture
- NIST Cybersecurity Framework (CSF)
- Secure operations map
- Vulnerability management
- Threat detection
- Incident response
- Business continuity
- Disaster recovery
- Infrastructure security
- Network security
- SAP Trust Center
- Cloud cybersecurity
View Full Table of Contents
- Foreword by Mariano Nuñez
- Who Should Read This Book
- Acknowledgments
- Juan Pablo Perez-Etchegoyen
- Gaurav Singh
- 1 What Is Cybersecurity?
- 1.1 CIA Triad
- 1.1.1 Confidentiality
- 1.1.2 Integrity
- 1.1.3 Availability
- 1.2 Identification, Authentication, Authorization, and Accountability
- 1.3 Nonrepudiation
- 1.4 Vulnerabilities, Threats, and Risks to SAP Applications
- 1.4.1 Security Vulnerabilities
- 1.4.2 Vulnerability Standards
- 1.4.3 Security Threats to SAP Applications
- 1.4.4 Risks to SAP Applications
- 1.5 OWASP Top 10
- 1.5.1 A01:2021 Broken Access Control
- 1.5.2 A02:2021 Cryptographic Failures
- 1.5.3 A03:2021 Injection
- 1.5.4 A04:2021 Insecure Design
- 1.5.5 A05:2021 Security Misconfiguration
- 1.5.6 A06:2021 Vulnerable and Outdated Components
- 1.5.7 A07:2021 Identification and Authentication Failures
- 1.5.8 A08:2021 Software and Data Integrity Failures
- 1.5.9 A09:2021 Security Logging and Monitoring Failures
- 1.5.10 A10:2021 Server-Side Request Forgery
- 1.6 Ransomware
- 1.7 Frameworks
- 1.7.1 National Institute of Standards and Technology Cybersecurity Framework
- 1.7.2 Center of Internet Security Framework
- 1.8 Security Research
- 1.9 Summary
- 2 Why Do SAP Landscapes Need Cybersecurity?
- 2.1 Evolution of Vulnerabilities and Threats to SAP Applications
- 2.1.1 Security Conferences and SAP Applications
- 2.1.2 Compromises Involving SAP Applications
- 2.1.3 Malware Involving SAP Applications
- 2.1.4 Cybercriminals and SAP Applications
- 2.1.5 Compromised Credentials in SAP
- 2.1.6 Noteworthy SAP Vulnerabilities
- 2.1.7 Actively Exploited SAP Vulnerabilities
- 2.2 Why Traditional SAP Security Can’t Protect against Cybersecurity Threats
- 2.2.1 Digital Transformations
- 2.2.2 Cloud Migrations
- 2.2.3 Hybrid Landscapes
- 2.2.4 Third Party: Open Integrations and Interfaces
- 2.2.5 Mitigating Financial Risks
- 2.2.6 Preventing Fraud
- 2.2.7 Complying with Regulations
- 2.2.8 Preserving Customer Trust
- 2.3 Obstacles to Cybersecurity Implementation
- 2.3.1 Lack of Ownership
- 2.3.2 Incorrect Reporting
- 2.3.3 Lack of Understanding
- 2.3.4 Lack of Responsibility Matrix among Different Stakeholders
- 2.3.5 False Sense of Security
- 2.4 Traditional SAP Security: What Works and What Doesn’t
- 2.4.1 SAP GRC Solutions
- 2.4.2 Identity and Access Management
- 2.4.3 Compliance and Audit Environment with SAP GRC Solutions
- 2.4.4 Internal and External Audits
- 2.4.5 Integration of Basis Administrators and SAP Security Teams
- 2.4.6 Management Oversight and Controls in Financial Reporting
- 2.4.7 SAP Functional Teams, Technical Teams, and Application Owners
- 2.4.8 Change Control Management
- 2.4.9 Application Audit and Logging Mechanism
- 2.5 Summary
- 4 Building a Cybersecurity Program for the SAP Landscape
- 4.1 National Institute of Standards and Technology Cybersecurity Framework
- 4.1.1 Core Functions, Categories, and Subcategories
- 4.1.2 Profiles and Tiers
- 4.2 Center for Internet Security Critical Security Controls
- 4.3 Secure Operations Map
- 4.3.1 Organization
- 4.3.2 Process
- 4.3.3 Application
- 4.3.4 System
- 4.3.5 Environment
- 4.4 Govern
- 4.5 Identify
- 4.5.1 Asset Management: Landscape Inventory
- 4.5.2 SAP Solutions
- 4.5.3 Secure Operations Map
- 4.6 Protect
- 4.6.1 Identity, Authentication, and Access Management
- 4.6.2 Awareness and Training
- 4.6.3 Data Security
- 4.6.4 Platform Security
- 4.6.5 Infrastructure Resilience
- 4.7 Detect
- 4.7.1 Configure and Enable Logging
- 4.7.2 Automated Anomaly Detection
- 4.8 Respond
- 4.9 Recover
- 4.10 Onapsis Platform
- 4.10.1 Onapsis Control: Application Security Testing Designed for SAP
- 4.10.2 Onapsis Assess: Get Deep Visibility into SAP System Risk
- 4.10.3 Onapsis Defend: Continuous Security Monitoring for SAP Applications
- 4.11 Summary
- 5 Vulnerabilities and Patches
- 5.1 SAP Notes
- 5.1.1 Notable SAP Notes
- 5.1.2 Anatomy of an SAP Note
- 5.2 Managing Vulnerabilities in the SAP Landscape
- 5.2.1 Defining the Scope
- 5.2.2 Identifying Vulnerabilities
- 5.2.3 Remediating Vulnerabilities
- 5.3 Patch Days
- 5.3.1 SAP Security Patch Day
- 5.3.2 Reviewing SAP Security Patch Day
- 5.3.3 Patch Days for Operating Systems
- 5.4 Summary
- 6 Threat Detection and Incident Response
- 6.1 Threat Management for SAP
- 6.1.1 Threat Actors
- 6.1.2 Source
- 6.1.3 Identity
- 6.1.4 Target
- 6.1.5 Vulnerability/Weakness
- 6.2 Threat Intelligence
- 6.2.1 Open-Source Intelligence
- 6.2.2 SAP-Specific Data Sources
- 6.2.3 Sites on the Dark Web
- 6.3 Anomaly Detection
- 6.4 Incident Response, Logging, and Monitoring in SAP
- 6.4.1 Logging and Monitoring in SAP
- 6.4.2 Incident Analysis and Response
- 6.4.3 Real Incidents
- 6.5 Summary
- 7 Business Continuity and Disaster Recovery
- 7.1 It’s a Matter of When, Not If
- 7.2 Are We Ready for Disaster?
- 7.2.1 Business Impact Analysis and Risk Assessment
- 7.2.2 High Availability
- 7.2.3 Stakeholders
- 7.2.4 Zero Trust
- 7.2.5 Defense in Depth
- 7.2.6 Awareness Training
- 7.3 Business Continuity/Disaster Recovery for SAP
- 7.3.1 Think NIST CSF
- 7.3.2 Define Scope
- 7.3.3 Key Stakeholders
- 7.3.4 Deployment Model
- 7.3.5 Incident Response
- 7.3.6 Cloud Adoption and the Shared Responsibility Model
- 7.3.7 Logging and Monitoring: Endpoint Detection and Response
- 7.3.8 Cybersecurity Insurance
- 7.4 Backup Strategy
- 7.5 Protect Your Keys
- 7.6 Disaster Recovery Tests
- 7.7 Summary
- 8 Infrastructure Security
- 8.1 Responsibilities and Models
- 8.2 Operating System Level Security: Secure by Design
- 8.2.1 Pre-Hardened Operating System Images
- 8.2.2 Authentication and Single Sign-On
- 8.2.3 Physical Security
- 8.2.4 Certifications
- 8.2.5 Disk Encryption
- 8.2.6 Zero Trust
- 8.2.7 Security Patches
- 8.2.8 Local Firewall
- 8.2.9 Minimal Operating System Packages Selection
- 8.3 Roles and Responsibility Matrix
- 8.4 Inventory
- 8.4.1 IT Asset Management
- 8.4.2 Asset Management Solutions
- 8.5 Privileged Access Management
- 8.6 Logging and Monitoring on the Infrastructure Level
- 8.7 Physical Data Centers versus Cloud Data Centers
- 8.7.1 On-Premise Physical Data Center
- 8.7.2 Cloud Data Centers
- 8.8 Antivirus and Anti-Malware Scanning
- 8.9 Summary
- 9 Network Security
- 9.1 Network Basics Concepts
- 9.1.1 Open System Interconnection Model
- 9.1.2 IP Address
- 9.1.3 Classless Inter-Domain Routing Range
- 9.1.4 Domain Name System
- 9.1.5 Dynamic Host Configuration Protocol
- 9.1.6 Network Address Translation
- 9.1.7 Secure File Transfer Protocol
- 9.1.8 HTTP and HTTPS
- 9.1.9 Simple Mail Transfer Protocol
- 9.1.10 Transmission Control Protocol/Internet Protocol vs. User Datagram Protocol
- 9.1.11 Allowlist vs. Denylist
- 9.1.12 Internet Protocol Security and Virtual Private Network
- 9.1.13 Firewall
- 9.1.14 Software Defined Networking
- 9.2 Network Security: Core Principles and Practices
- 9.2.1 Redundancy, Fault Tolerance, and High Availability
- 9.2.2 Monitoring
- 9.2.3 Identity and Access Management
- 9.2.4 Vulnerability and Patch Management
- 9.3 Network Security for SAP
- 9.3.1 Cloud Network Security
- 9.3.2 RISE with SAP
- 9.4 Summary
- 10 SAP Trust Center
- 10.1 Resources in SAP Trust Center
- 10.1.1 Security
- 10.1.2 Compliance
- 10.1.3 Privacy
- 10.1.4 Agreements
- 10.1.5 Cloud Service Status
- 10.1.6 Data Centers
- 10.1.7 Cloud Delivery Options
- 10.1.8 My Trust Center
- 10.2 SAP for Me
- 10.3 Summary
- 11 Impact of SAP S/4HANA, RISE with SAP, and the Cloud on Cybersecurity
- 11.1 SAP S/4HANA Migration and What It Means for Cybersecurity
- 11.1.1 Cloud’s Five Essential Characteristics
- 11.1.2 Cloud Service Models
- 11.1.3 Cloud Deployment Models
- 11.1.4 SAP S/4HANA Deployment Models
- 11.2 What the Cloud Means for SAP Cybersecurity
- 11.2.1 Shared Responsibility Model
- 11.2.2 RISE with SAP
- 11.2.3 Trust, But Verify
- 11.2.4 SAP Business Technology Platform
- 11.3 Summary
- The Authors
- Index
