Best SAP Security Practices for Cloud-Based Applications

A huge part of an organization’s SAP environment is now cloud-based due to the inherent flexibility, on-demand access to scalable resources, simplified management, accelerated innovation, reduced costs, and reduced upfront implementation effort in cloud computing.

Many companies have adopted a cloud-first policy. Software giants like SAP have also invested heavily to make cloud computing the core of the enterprise IT environment, relieving businesses of the management and maintenance costs and efforts. However, SAP security remains a shared responsibility between the cloud service provider and the business. In this post, we’ll discuss best practices for businesses to maintain a secure posture for the cloud-based components of their IT environments.

We’ll begin with a discussion of SAP’s clean core policy, and then we’ll discuss general best practices.

Clean Core Policy

Every organization and the way it conducts business is different. Even within the same business vertical, pick any two companies and analyze their technologies, processes, and business objectives, and you’ll find significant differences. Therefore, each organization needs software to be customized to its requirements. Every business running SAP hires ABAP developers to develop custom code, reports, and objects. You might be amazed by the degree of customization achieved even in smaller organizations. However, one major reason for such a high degree of customization in small organizations is a lack of governance and control.

Another way to look at customization is to see it as technical debt. The more you deviate from the standard, the higher the technical debt. It’s viewed as a cost center in terms of maintenance and the complexity it adds to upgrades. It’s also viewed as a factor that slows down innovation.

To leverage its cloud-first policy to its fullest, SAP advises businesses using its cloud offerings to maintain a clean core. Maintaining a clean core is not against customization; it encourages customization outside of the SAP core. Especially in cloud-based SAP S/4HANA offerings (RISE or GROW with SAP), SAP encourages its customers to keep the SAP S/4HANA environment as close to standard as possible and implement customizations on the SAP BTP platform.

We recommend that you keep an eye on the following items to maintain a clean core:

Processes

Processes are a key area in which a company can easily deviate from established best practices and introduce its own custom elements. Custom processes may, in the short term, benefit the company, but in the long run, they will have a negative cost impact. SAP encourages businesses to implement standard processes and practices. They can use products like SAP Signavio to analyze their business processes and align them with standards.

Data

Data drives business, as reports and dashboards have a significant impact on decision-making.

Hence, it is critical for a business to ensure that all its data, whether master data or transactional data, is clean, free of noise and bias. It must be consistent and compliant with the models governing the operations.

Operations

Day-to-day operations must be streamlined by implementing controls, monitoring, and other governance measures to ensure they remain standard. They consume processes and produce data. Hence, to maintain a clean core, operational discipline is essential. Tools like SAP Cloud ALM and Focused Run can provide insights into operations and help businesses steer them.

Integration

Nowadays, modern enterprises have large IT landscapes, and the SAP environment in such a landscape has a huge number of integration points with other SAP and non-SAP systems. SAP’s clean core policy advocates that enterprises use standard APIs for integration rather than tightly coupled custom ones. Communications and data must flow freely among integrated systems. SAP Business Accelerator Hub maintains a huge catalog of releases, APIs, adaptors, and business add-ins (BAdIs) for the benefit of businesses.

Extensions

SAP advises businesses to develop customizations as extensions and custom applications in SAP BTP without touching the SAP-delivered standard code. That way, the clean core is maintained, and small customizations to meet the business’s essential needs are also fulfilled.

By keeping the SAP environment’s core in its pristine form, as close as possible to the delivered one, businesses can expect to gain many benefits—or example:

• Without customizations, upgrades will be faster and safer as there will be no need to test them.
• With a lower cost of upgrades and almost no time/resources spent on maintaining customizations during upgrades, the total cost of ownership (TCO) will be lower.
• By keeping the systems, processes, and data free of customizations, you are following a time-tested, predictable operational model. Hence, issue resolution and break/fix will follow standard patterns, making them more efficient and effective and reducing the rate of operational interruptions.

How does a clean core environment benefit security? In an SAP environment with a clean core, customization will be minimal. Custom code is a source of security vulnerabilities in many organizations. SAP standard code is shared with security experts for review; vulnerabilities are identified and patched via security SAP Notes. Custom code is immune to such reviews and scans, and vulnerabilities won’t surface until they’re exploited. Also, with a clean core, SAP patches—especially the critical ones addressing zero-day exploits—will be easier to implement. Also, customizations being implemented in SAP BTP is beneficial to security because SAP BTP applications for standard secure DevOps techniques can be implemented there easily.

We strongly recommend that businesses adopt a more standards-oriented posture. A change control board should evaluate every proposal for customization and its impact on business, operations, and maintenance. If there is an iota of doubt about its long-term feasibility, then the change proposal should be rejected.

Best Practices

Let’s discuss best practices for maintaining an enterprise’s cloud security posture. SAP BTP alleviates many of an enterprise’s concerns by providing feature-rich, robust applications and services to secure their environments. The scope of these applications and services extends beyond SAP BTP; they can be applied across the entire cloud computing environment, both SAP and non-SAP, and even to on-premise systems in a hybrid environment: They should be leveraged. Also, companies can leverage products from many third-party vendors, such as Pathlock, Onapsys, and Security Bridge, which offer useful functionality to complement SAP products.

The following are some best practice areas for securing cloud-based SAP applications. Note that this list is neither exclusive nor applies to all environments. This can serve as a baseline for your environment. Depending on your environment, user population, industry, and regulatory requirements, you can make a list of best practices to implement in your organization and ensure that they are strictly followed. Any exception should be documented and approved by management:

Robust IAM

• Centralize IAM with SAP Cloud Identity Services and integrate the enterprise IdP.
• Enforce MFA at least for administrators and superusers.
• Apply RBAC and the principle of least privilege.
• Minimize use of passwords; use secure protocols SAML 2.0, OIDC, and OAuth 2.0.

Network Security

• Implement network segmentation for different trust zones of the network.
• Implement zero-trust connectivity; authenticate and authorize every user, system, and API.
• Have private connectivity to cloud services; use SAP Private Link service where applicable.
• Use the cloud connector; never expose backend systems to the internet.

Secure Interfaces

• Use SAP Integration Suite with the appropriate configuration for each component.
• Secure APIs with strong protocols such as OAuth 2.0 and mTLS.
• Apply IP whitelists and rate limiting.
• Validate payloads and schemas coming through the APIs; monitor traffic.

Encrypt Everything

• Encrypt data at rest and in transit with the strongest possible cipher suites.
• For databases, employ data anonymization and masking.
• Use SAP Credential Store to manage keys, certificates, and other secrets.
• Ensure data residency controls are in place. Also implement automated retention and deletion policies.

Secure Development

• Follow SAP’s clean core policy, and follow SAP’s secure coding guidelines (SecDevOps).
• Enforce automatic review of custom code.
• Ensure extensive testing—both Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
• Avoid hard-coded credentials.

Monitor and Respond

• Enable the SAP Audit Log service on SAP BTP and configure all critical events to be logged.
• Configure real-time monitoring of critical logs and subscribe to events identified as suspicious.
• Implement SAP Enterprise Threat Detection or route logs to the enterprise SIEM tool.
• Use AI-enabled log analysis tools for predictive analytics of security logs.

Continuous Vulnerability Scanning

• For on-premise systems, monitor patches released on the security patch day and take immediate action if required.
• Scan the system regularly for vulnerabilities
• Enforce SAP’s baseline security policy.
• Review role collections and user access regularly.

Compliance

• Identify the mandatory regulations and those audited for your company.
• Develop a set of controls, ensure they are effective, and follow a control calendar to ensure they are diligently operated and that evidence is stored for audit.
• Maintain a risk register and regularly review it to keep it up to date.
• Develop a RASCI chart to identify officers responsible for various security tasks.

Developing a checklist to implement security best practices in your company is a testimony to your commitment to security. We strongly recommend creating a list of best practice items, then creating a list of action items to implement the security controls.

Conclusion