Security Remote Service Content Oravle

Public
SAP HANA Security

Remote Services Content
SAP SE, October 2016

Motivation Typical Issues in todays SAP HANA systems
Sensitive data is written to Security audit log

User SYSTEM is not de-activated diagnosis files directory is not configured at all
or it is even in daily use for and kept for months
administration and support tasks Latest security patches missing
Communication via insecure connections
Obsolete technical users and other users Insecure network configuration that allows to access
HANA internal communication from outside
Users allowed
Secure default configuration to read all data Several users with various critical authorizations
overwritten with modifications (development and/or administration privileges)
from earlier releases in productive system
How to define, implement and monitor the security of your SAP HANA Platform ?
2016 SAP SE or an SAP affiliate company. All rights reserved. Public 2
Classification of Security Services
Comparison against Comparison against

SAP recommendations Company
Security companys security policy
Security in EarlyWatch Alert (EWA) Policy Management Dashboard
Overview
Companys
SAP Security
Baseline
Detailed Services Configuration Validation
Detail Target
System
Security Optimization Service (SOS)
System Recommendations
Security Notes in the SAP Support Portal


EWA:
Overview Productive
SAP Security
(10 Checks)
Baseline
Template:
(8 requirements)
NEW SOS: Productive Configuration
Detail (27 checks) Validation:
Target Stores available
HANA Security Checklist / Security Mini System covering 20 SOS checks
Check (28 Checks)
System Recommendations:
also checks Security Notes relevant for SAP HANA
Agenda
1. Security Optimization Service (SOS)
2. SAP EarlyWatch Alert (EWA) Report
3. SAP HANA Security Baseline Template and Configuration Validation
4. Monitoring and Alerting Infrastructure in SAP Solution Manager
5. System Recommendations

SOS remote service for SAP HANA currently based on 27 checks
Security Optimization Service (SOS) for SAP HANA
Facts Remote service delivered by an SAP Support Engineer.

Service Goal:
Up to 27 manual checks delivered through standard
Keep the security of your SAP system at a high level by remote connection.
verifying critical security properties, identifying potential Short Questionnaire to capture custom specific
security issues and benefitting from recommendations on information.
how to improve the security of your system. Primary focus: SAP HANA Database
Source: https://support.sap.com/sos Expert checks available for non-standard scenarios.

Approach is consistent with SOS for ABAP and JAVA
Enable Customers to run SAP HANA in a secure manner no matter if
HANA is used as a database of a traditional ABAP or JAVA system or
as a platform for IoT or other innovative scenarios. How to Standard procedures for ordering an SAP
order Remote Service apply
[Standard delivery 1 Day]

Scope
Maintenance of SAP Code
Single or Multi Configuration Parameters

Tenancy Encryption Master Keys
Auditing
Diagnosis Files
Users and Authorizations
[Custom tailored expert delivery 2 Days]
Database Platform
To be defined in scoping call

When to book? Consider to book a Security Optimization Service for one or multiple SAP HANA
Systems if at least one of the following statements is true for you!
You are You want to
New to SAP HANA. Verify critical security properties.
Deploying new HANA capabilities like Multi Identify potential security issues.
Tenancy, XS Advanced Engine, Smart Data
Integration, Streaming, Learn about options to further improve the security
of your system.
Increasing the security level of your system due
to new requirements from business or Discuss customer-specific requirements directly
compliance side. with an SAP security expert
In the process of bringing your SAP HANA Analyze the security level of your SAP HANA as
platform operation to a higher maturity level. basis for a Security Engagement with SAP or for
your internal project

SOS Delivery Procedure
Standard booking and service preparation procedures apply.
Questionnaire Remote Analysis Report & Wrap-up Call
Usage scenarios Service report

System
handover date Manual checks (27 Wrap-up call
Technical users checks) Results and
Rating of vulnerabilities recommendations
Special users
Explanation
Expert check on non-standard Discussion of customer

scenarios requirements and related
capabilities in SAP HANA
and SAP Solution Manager

Security Optimization Service Implemented Checks
Check Group Check Check Group Check

Maintenance of Password Policy is weaker than SAP recommendation
Maintenance status of current HANA database revision
SAP Code Authentication No protection against trivial passwords (Password
SAP HANA network settings for internal Blacklist)
communication between HANA services User SYSTEM is activated
Network and (listeninterface)
Communication SAP HANA network settings for communication User SYSTEM has recently been used
between replication sites (listeninterface) Multiple invalid connection attempts for user SYSTEM
TLS protection of JDBC / ODBC client connections Several users with multiple invalid connection attempts
Users Users with disabled password lifetime
Secure Data Change of Encryption Root Keys (as of SPS 12)
Persistence Change of SSFS Master Keys Users with last password change before system
handover
SAP HANA Auditing Status No use of Restricted Users
Valid SAP HANA Audit Policies exist Potentially obsolete users
Auditing Default audit trail is not set to System Log or Column Users with privileges that must not be assigned in
Store table productive systems
Policy specific audit trails are not set to System Log or Authorizations
Critical privileges assigned to many users
Column Store table
Users with directly granted privileges
Traces configured on debug level
Diagnosis Files SQL trace including results configured
Runtime dumps older than 42 days Red = Checks decisive for an overall red rating of the SOS report.
Details
System User
Often we find low awareness about critical authorizations of standard user SYSTEM (and
that user SYSTEM is not a required user after the initial system setup).
Activation Status and Validity of User SYSTEM Evaluated Risk High

Active standard users are an easy target for hacking
User SYSTEM is currently active and valid. attacks due to being available in every system.
User SYSTEM is currently active but out of validity date. Furthermore the user SYSTEM is like a super user with
very powerful user authorizations that cannot be revoked.
Recent use of user SYSTEM Evaluated Risk High

If the user SYSTEM is used, then user activity in the
Use within last 7 days system can hardly be traced back to a unique identity.
Use within in last 8 to 30 days
Confidentiality of SYSTEM user password Evaluated Risk High

If the date of last password change is before system
PASSWORD_CHANGE_TIME < Communicated Handover handover or if date of password change cannot be
Date determined, the password of user SYSTEM might be
known outside your organization. This could lead to
unauthorized access.

Details
Critical Authorizations
Users with critical privileges or with roles that must Evaluated Risk High
not be assigned in productive systems These authorizations allow users to access or change any data
Number of users having critical privileges without further authority check or authorize users to execute
List of users activities that are only allowed to be used by SAP Development.
Recommendation:
Make sure that the authorizations listed above are not granted to
users in a productive environment.
Review the users listed in the table below and revoke
authorizations unless they are required for a documented,
approved reason.
Evaluated Risk Medium
Users with critical system privileges Critical authorizations can enable users to perform actions that
Number of users having critical system privileges compromise the security of the system or its data. The more
List of users users are assigned the higher is the risk.
Evaluated Risk Medium
Users with directly granted privileges Privileges, that are granted directly to a user, can hardly be
Number of Users related to a specific role in the organization and the respective set
List of users by number of directly granted privileges of tasks. As result it is difficult to limit a users authorizations
according to the need-to-know principle.

Details
Auditing
Auditing on database level gets a must when there are end-users and project resources
accessing HANA DB directly (e.g. web applications with XS (Classic) / XSA Engine)
SAP HANA Auditing Status Evaluated Risk - High

If auditing is disabled, then the execution of critical
Parameter global_auditing_state does not exist or is other activities including unauthorized access or changes may
than true stay undetected. Information that is required for the
analysis of security incidents might be missing.
Valid SAP HANA Audit Policies exist Evaluated Risk High
If no valid Audit Policies are configured, then only
No valid policy is active changes to the audit configuration itself will be tracked.
The execution of critical activities including unauthorized
Inappropriate Default Audit Trail Type access or changes will not be audited and may stay
undetected. Information that is required for the analysis
Parameter default_audit_trail_type is CSVFILE rather than of security incidents might be missing.
CSTABLE or SYSLOGPROTOCOL Evaluated Risk High / Medium
With the use of CSVFILE, the Audit Trail can be
Policies with inappropriate Audit trail type accessed by users who are authorized to view diagnosis
Rating when at least 1 policy with audit trail type CSVFILE is files. Unauthorized access and manipulations to the
defined audit trail cannot be traced back to the user.
Details
Network Settings
Evaluated Risk - High

If parameters are set incorrectly, the SAP HANA service ports
Public used for internal / system replication communication are
communication exposed to a public network and can be used to attack the
SAP HANA system.
Recommendation:
Configure separate networks on infrastructure level
communication
Set the parameter listeninterface to recommended value

Internal
(e.g. .internal for distributed system)

Add parameters with appropriate mapping of IP address to
hostname for all hosts of the SAP HANA system.
Follow the detail instructions in SAP Note 2183363 and
KBA 2222200.
SOS checks the parameter settings for internal communication

and for system replication communication and validates the
System Replication specified IP addresses.
communication
Alternatives
Customers can use the Security Checklist provided as part of the SAP HANA documentation or
Security MiniChecks provided with SAP Note 1969700 for analyzing the system on their own.

HANA Security in SAP EarlyWatch Alert
10 checks
HANA Security in SAP EarlyWatch Alert (EWA)
Service Goal: Facts 1. Implemented Checks

Provide automated weekly check on most
critical security findings (including newly
detected vulnerabilities) that
should be fixed as soon as possible.
Provide an out-of-the box means for assuring
a secure configuration.
Source: SAP Note 863362
How to SAP EarlyWatch Alert is included in SAP Maintenance.

order Only its configuration in SAP Solution Manager is required,

EWA Summary

EWA Summary

EarlyWatch Alert Chapter Security
Overview

EarlyWatch Alert HANA Security Checks
DATA ADMIN Privilege (1/2)

DATA ADMIN Privilege (2/2)

Password Policy Critical Parameters
If one of these three parameters gets a non-green rating i.e. there is a severe finding regarding the password
policy enforcement then additional password complexity parameters are shown for information and
recommendation (see next slide).

Password Policy Additional Parameters
The following list of password complexity parameters, current values and recommendations is shown only, if one
of the three critical password parameters (see previous slide) received a non-green rating.
These optional parameters listed on this slide never trigger an EWA HANA Password Policy entry on their own.

Audit Trail Settings

SQL Trace Level

Internal Network Settings / SSFS Master Encryption Key

SAP HANA in Security Baseline Template
and Configuration Validation

Overview
SAP Security
Companys
Baseline
SAP Security
Template:
Baseline
(8 requirements)
Configuration
Detail Validation:
Target Stores available
System covering 20 SOS checks

The SAP Security Baseline Template Package
The SAP Security Baseline Template is a template document provided by SAP on how an
organization specific SAP Security Baseline could be structured. It is prefilled with selected baseline
relevant requirements and corresponding concrete values as recommended by SAP.
(see SAP Knowledge Base Article 2253549 The SAP Security Baseline Template)
The SAP Security Baseline Template Package contains

SAP Knowledge Base Article 2253549 providing overview and introduction
The SAP Security Baseline Template (October 2016: version 1.9)
A package for customizing the Configuration Validation to verify baseline template requirements, which can
technically be checked. (October 2016: version 1.9 CV-2)
It consists of
o Data files and transports to customize Configuration Validation
o Documentation on how to upload/transport these data files and transports
o Documentation on the customizing, target systems and reporting options of this package

SAP Secure Operations Map
Security Emergency
Security Compliance Audit Cloud Security
Governance Concept
Users and Authentication and Security Review

Secure Operation Support Security
Authorizations Single Sign-On and Monitoring
Secure Setup Secure Configuration Communication Security Data Security
Security Maintenance
Secure Code Custom Code Security
of SAP Code
Operating System and

Infrastructure Security Network Security Frontend Security
Database Security

SAP Secure Operations Map
The 16 Secure Operation Tracks
cover the following topics:
Security Governance: Adopt security policies for your
SAP landscape, create and implement an SAP Security Baseline
Audit: Ensure and verify the compliance of a companys IT infrastructure and operation with internal and external guidelines
Cloud Security: Ensure secure operation in cloud and outsourcing scenarios
Emergency Concept: Prepare for and react to emergency situations
Users and Authorizations: Manage IT users and authorizations including special users like administrators
Authentication and Single Sign-On: Authenticate users properly but only as often as really required
Support Security: Resolve software incidents in a secure manner
Security Review and Monitoring: Review and monitor the security of your SAP systems on a regular basis
Secure Configuration: Establish and maintain a secure configuration of standard and custom business applications
Communication Security: Utilize communication security measures available in your SAP software
Data Security: Secure critical data beyond pure authorization protection
Security Maintenance of SAP Code: Establish an effective process to maintain the security of SAP delivered code
Custom Code Security: Develop secure custom code and maintain the security of it
Network Security: Ensure a secure network environment covering SAP requirements
Operating System and Database Security: Cover SAP requirements towards the OS and DB level
Frontend Security: Establish proper security on the frontend including workstations and mobile devices
What is Configuration Validation?
The Idea behind Configuration Validation
A reporting on actual configurations against a pre-defined, custom-specific Reference System to
Goal: understand how homogeneous the configuration of systems is.
Reference System Compared Systems

System 1 System N
Configuration Items
Software Packages
Configuration Items ... Configuration Items
ABAP Notes Configuration ABAP Notes ABAP Notes

Kernel level Validation Software Packages Software Packages
Transports Transports Transports
Parameters
... Parameters
... Parameters
...
Compliance with
Reference System
... Typical questions are:
System 1 System 2 System N All systems on a certain OS level or DB level?
Software Packages Template configuration (SAP or DB parameter) applied on
all systems?
ABAP Notes
No kernel older than 6 month on all systems?
Transports Security policy settings applied? Security defaults in place?
... Have certain transports arrived in the systems?
Content Deliverables Configuration Items Overview
Available Data Stores

for SAP HANA
HANA Revision
HANA Parameter
Audit Policies
Users
Special Privileges
Critical Combinations of
Privileges

Big Picture: Reporting / Alerting / Management Dashboard
Configuration Validation Target Systems can be used in several areas
Configuration Management
Validation Dashboard
System
Monitoring /
Reporting Alerting

HANA Security in Monitoring and Alerting
HANA Security in Monitoring and Alerting
Goal: Facts 1. Infrastructure

Provide automated notifications on security issues,
Matured infrastructure
non-compliant configuration or suspicious user activity / system behavior.
Highly flexible
Easy extensibility
2. Implemented Checks
Currently very few
security-related checks
available.
3. Custom Adoption
Custom specific Alerts e.g.
based on HANA system
views or Configuration
Validation

Available Checks
HANA Statistics Server Alerts related to Security

(for triggering Operations Team - also available in SAP Solution Manager)
Configuration Mini Checks related to HANA Security

(for ad-hoc analysis e.g. via Solution Manager DBA Cockpit)
Checks that would trigger an Alert in
Security team (rather than in Operations)
are with very few exceptions not available.
Custom specific metrics, alerts, reports and
Dashboards are possible.

Architecture Data Sources and Flow
Typical implementation effort: 1 day per Custom Alert

Goal: Facts (on HANA)

Support an effective Security Patch Management Process by automatically System Recommendations runs in
identifying the applicable SAP Security Notes and by providing further Solution Manager
means for implementation and tracking
Notes already covered by current
revision are automatically filtered out
No need to filter all applicable
components (currently not just HAN*)
Automatic detection of Revision
number from landscape data
Coding corrections usually require a
revision update via HANA LM Tools
Workarounds usually require a
(manual) Parameter Change
Notes can be manually confirmed or
marked not relevant

Summary and Open Discussion / Q & A
Thank you
Contact information:
AGS Security Services

securitycheck@sap.com
2016 SAP SE or an SAP affiliate company. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company.
SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate
company) in Germany and other countries. Please see http://global12.sap.com/corporate-en/legal/copyright/index.epx for additional trademark information and notices.
Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors.
National product specifications may vary.
These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP SE or its
affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or SAP affiliate company products and
services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as
constituting an additional warranty.
In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop
or release any functionality mentioned therein. This document, or any related presentation, and SAP SEs or its affiliated companies strategy and possible future
developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time
for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-
looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place
undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.

Security Remote Service Content Oravle

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security Remote Service Content Oravle

Uploaded by

Copyright:

Available Formats

Public

SAP HANA Security

SAP SE, October 2016

Sensitive data is written to Security audit log

Communication via insecure connections

Comparison against Comparison against

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 3

Comparison against Comparison against

1. Security Optimization Service (SOS)

2. SAP EarlyWatch Alert (EWA) Report

3. SAP HANA Security Baseline Template and Configuration Validation

4. Monitoring and Alerting Infrastructure in SAP Solution Manager

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 5

Facts Remote service delivered by an SAP Support Engineer.

Source: https://support.sap.com/sos Expert checks available for non-standard scenarios.

[Standard delivery 1 Day]

Single or Multi Configuration Parameters

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 7

You are You want to

New to SAP HANA. Verify critical security properties.

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 8

Questionnaire Remote Analysis Report & Wrap-up Call

Usage scenarios Service report

Expert check on non-standard Discussion of customer

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 9

Check Group Check Check Group Check

Activation Status and Validity of User SYSTEM Evaluated Risk High

Recent use of user SYSTEM Evaluated Risk High

Confidentiality of SYSTEM user password Evaluated Risk High

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 11

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 12

SAP HANA Auditing Status Evaluated Risk - High

Evaluated Risk - High

Set the parameter listeninterface to recommended value

(e.g. .internal for distributed system)

SOS checks the parameter settings for internal communication

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 15

Service Goal: Facts 1. Implemented Checks

Source: SAP Note 863362

How to SAP EarlyWatch Alert is included in SAP Maintenance.

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 17

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 18

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 19

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 20

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 21

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 22

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 23

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 24

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 25

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 26

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 27

Comparison against Comparison against

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 29

The SAP Security Baseline Template Package contains

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 30

Users and Authentication and Security Review

Secure Setup Secure Configuration Communication Security Data Security

Operating System and

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 31

Reference System Compared Systems

ABAP Notes Configuration ABAP Notes ABAP Notes

Available Data Stores

2016 SAP SE or an SAP affiliate company. All rights reserved. Public 34