What is the meaning of this term?

What are the actions we can take to protect an SAP system?

Cyber Security

This term identifies all the actions to be put in place to protect information systems. That is, ensuring the availability, confidentiality and integrity of systems (CIA principle: Confidentiality, integrity and availability).

It is a term widely used today and often overused by cybersecurity companies, read more about it here.

What actions can be taken to protect these systems?

There are several levels of action, the main ones being the following:

• Physical security, which is all measures to physically protect data and information. For example, physical access control (turnstiles, company entry badges, locks padlocks etc), but also cameras, alarms and other physical protections precisely
• Logical security, that is, all those "digital" control measures. Authentication systems, passwords, single sign on, log management systems, SIEM, intrusion detection systems, antivirus etc.

Beyond the measures taken, whether they are physical or logical security, it becomes essential to conduct a risk assessment.

We should always take into consideration what data we are protecting and what degree of protection we are willing to handle.

Risk analysis allows us to understand all the treatments that need to be taken to protect an SAP system, based on the information it contains. Personal data or strategic business/reserved data.

What are the macro areas of focus?

• Communication security (enabling encryption)
• That is, activation of encryption in SAP communication channels, thus SNC (Secure Network Communication) or HTTPS.
• Security of stored data (data encryption)
• Activation of database encryption mechanisms, in the case of native HANA
• Application security (SAP security)
• Definition of a security model or authorization concept SAP Identity management
• Identity management
• Activation of a system for identity management e.g. Identity Management
• Hardening of systems (infrastructure/operating systems/databases)
• Correlation and logging of security events e.g. via SIEM (security information and event management)
• Security incident management 
• Training
• To all personnel as security awareness and professional training to SAP security specialists. This represents the biggest security problem today. After protecting physical and logical security.

What are the actions to verify that the aforementioned is correctly set up?

Performing of of vulnerability assessments/penetration tests or periodic audits becomes strategic to understand whether areas above have been properly set up and configured.

What are the main visible risks of inaction?

1. Risks of corporate fraud
2. Data theft
3. Reputational damage
4. Loss of certifications as a result of non-compliance (e.g., GxP)
5. Sanctions (e.g., noncompliance in personal data management, GDPR)
6. Corporate financial statements not approved by auditors
7. Loss of competitiveness compared to industry players

Topics: auditing, social engineering, cyber security