This post will discuss the foundational elements of an application security program for SAP HCP deployments. Without direct responsibility for management of hardware and physical networks you lose the traditional security data capture points for traffic analysis and firewall technologies. The net result is that, whether on PaaS or IaaS, your application security program becomes more important than ever as what you have control over. Yes, SAP provides some network monitoring and DDoS services, but your options are are limited, they don’t share much data, and what they monitor is not tailored to your applications or requirements.

Any application security program requires a breadth of security services: to protect data in motion and at rest, to ensure users are authenticated and can only view data they have rights to, to ensure the application platform is properly patched and configured, and to make sure an audit trail is generated. The relevant areas to apply these controls to are the Hana in-memory platform, SAP add-on modules, your custom application code, data storage, and supplementary services such as identity management and the management dashboard. All these areas are at or above the “water line” we defined earlier. This presents a fairly large matrix of issues to address.

SAP provides many of the core security features you need, but their model is largely based on identity management and access control capabilities built into the service. The following are the core features of SAP HCP:

• Identity Management: The SAP HANA Cloud Platform provides robust identity management features. It supports fully managed HCP identities, but also supports on-premise identity services (i.e.: Active Directory) as well as third-party cloud identity management services. These services store and mange user identities, along with role-based authorization maps to define authorized users’ resource access.
• Federation and Token-based Authentication: SAP supports traditional user authentication schemes (such as username and password), but also offers single sign-on. In conjunction with the identity management services above, HCP supports several token-based authenticators, including Open Authorization Framework (OAuth), Security Assertion Markup Language (SAML), and traditional X.509 certificates. A single login grants users access to all authorized applications from any location on any device.
• Data at Rest Encryption: Despite being an in-memory database, HCP leverages persistent (disk-based) storage. To protect this data HCP offers transparent Data Volume Encryption (DVE) as a native encryption capability for data within your database, as well as its transaction logs. You will need to configure these options because they are not enabled by default. If you run SAP Hana in an IaaS environment you also have access to several third-party transparent data encryption options, as well as encryption services offered directly by the IaaS provider. Each option has cost, security, and ease-of-use considerations.
• Key Store: If you are encrypting data, then somewhere encryption keys are in use. Anyone or any service with access to keys can encrypt and decrypt data, so your selection of a keystore to manage encryption keys is critical for both security and regulatory compliance. HCP’s keystore is fully integrated into its disk and log file storage capabilities, which makes it very easy to set up and manage. Organizations who do not trust their cloud service provider, as well as those subject to data privacy regulations which require they maintain direct control control of encryption keys, need to integrate on-premise key management with HCP. If you are running SAP Hana in an IaaS environment, you also have several third-party key management options – both in the cloud and on-premise – as well as whatever your IaaS provider offers.
• Management Plane: A wonderful aspect of Hana’s cloud service is full administrative capabilities through ‘Cockpit’, API calls, a web interface, or a mobile application. You can specify configuration, set deployment characteristics, configure logging, etc. This is a wonderful convenience for administrators, and a potential nightmare for security because an account takeover means your entire cloud infrastructure can be taken over and/or exposed. It is critical to disallow password access and leverage token-based access and two-factor authentication to secure these administrative accounts. If you are leveraging an IaaS provider you can disable the root administrator account, and assign individual administrators to specific SAP subcomponents or functions.

These are foundational elements of an application security program, and we recommend leveraging the capabilities SAP provides. They work, and they reduce both the cost and complexity of managing cloud infrastructure. That said, SAP’s overarching security model leaves several large gaps which you will need to address with third-party capabilities. SAP publishes many of the security controls they implement for HCP, but these capabilities are not shared with tenants, nor is raw data. So for many security controls you must still provide your own. Areas you need to address include:

• Assessment: This is one of the most effective means of finding security vulnerabilities with on-premise applications. SAP’s scope and complexity make it easy to accidentally misconfigure insecurely. When moving to the cloud SAP takes care of many of these issues on your behalf. But even with SAP managing the underlying platform there are still add-on modules, configurations, and your own custom code to be scanned. Running on IaaS, assessment scans and configuration management remain a central piece of an application security program. You will need to adjust your deployment model because many of the more effective third-party scanners run as a standalone machine (in AWS, an AMI), while others run on a standalone central server supported by remote ‘agents’ which perform the actual scans. You will likely need to adjust your deployment model from what you use on-premise, because in the cloud you should not be able to address all servers from any single point within your infrastructure.
• Monitoring: SAP regularly monitors their own security logs for suspicious events, but they don’t share findings or tune their analysis to support your application security efforts, so you need to implement your own monitoring. Monitoring system usage is one security control you will rely on much more in the cloud, as your proxy for determining what is going on. Your traditional IDS, IPS, firewalls, and network monitoring systems don’t work well on cloud infrastructure, because software-defined networks don’t provide the events or access these security plaforms are designed around. It is important to understand that SAP Hana is very different than other enterprise applications, so generic tools don’t work very well with Hana to begin with. Some third-party security monitoring products (not from SAP) are designed to understand SAP p-codes and transactions. They show you how Hana is being used and by whom, and can perform behavioral assessments to detect anomalies activities. Monitoring also captures events which do not appear in audit logs or cloud provider logs, which makes it particularly useful for auditing, compliance, and forensic investigation.
• Logging and Auditing: HCP provides database logs, default trace logs, and HTTP access logs. But logs from things like Cockpit and administrative activity are unavailable. As mentioned above, you may need to supplement activity logs with monitoring services. In IaaS, basic event logs of API calls and resource requests are captured by the service if you choose to enable logging; logs can be saved to disk, raw storage (such as S3 buckets), Splunk, your SIEM, or logging tools of your choice.
• Configuration Management: To promote consistency across the cloud SAP records deployment and configuration data in a proprietary XML document so that resources instantiate with the consistent platforms, patch revisions, and configurations. But this is a proprietary document and SAP does not share the specifics with HCP customers. That said, the approach provides consistency, giving each application server the same modules, versions, and configuration. For PaaS and IaaS environments we recommend capturing settings into a standard template and using it to launch new services.
• Penetration Testing: We are big fans of penetration testing at Securosis. Pen testers commonly discover unknown defects in applications and deployments, because they examine and probe applications in ways developers and operations teams do not. So you may be disappointed that you cannot penetration test cloud services. Many cloud providers prohibit it altogether; others allow you to test only your own applications, with prior approval. SAP performs penetration testing on their own services, but does not currently allow customers to do the same. This could change in the future, so we encourage you to ask SAP and see if they will allow it under controlled circumstances.

Custom Code Security

Several other aspects of application security fall under application development, which we cannot address in depth here despite its importance to your security program. SAP advocates use of Cloud Foundry – either open source or commercial variants – for application development. Cloud Foundry is what we call “security neutral”: it can be made secure but does not inherently provide security, so code integrity is up to you. Similarly, for containers like Docker you need to ensure you pull apps from trusted repositories and ensure your container build process is secure. For third-party applications SAP offers the App Center repository to ensure you don’t accidentally download infected software. And as many organizations quickly discover when developing applications for the cloud, breaking apps into smaller microservices produces dividends in scalability, reduced complexity, and resiliency. Finally, development teams using Continuous Integration can leverage on-demand cloud resources to stand up replicas of your production environment, perform private functional and security testing, and shut down resources when finished.

To recap, you will focus more security resources on application security than ever before. Even so, the loss of penetration testing data on your environment requires greater focus on monitoring application usage. Regardless, leveraging a combination of third-party tools and cloud-native features, your cloud applications can be far more secure than the on-premise variants. It requires up-front planning but rewards you with improved security and the operational benefits of improved scalability, easier management, and lower cost.