Session ID: B410 A Secure Future Today with SAP NetWeaver

Transcription

1 Session ID: B410 A Secure Future Today with SAP NetWeaver

2 Sarah Maidstone, SAP AG

3 The Trouble with Security How Can SAP NetWeaver Help? From Here to ESA: Securely Summary

4 The Trouble with Security How Can SAP NetWeaver Help? From Here to ESA: Securely Summary

5 The Trouble with Security Opportunity Innovation Flexibility CEO Security Technology Manageability CIO CFO Timeliness Accuracy Transparancy IT Security IT Risk Management Auditing SAP AG 2004, SAP TechEd / Session ID / 5

6 Is That There s No Quick Fix You probably have Responsibility split across different divisions Different takes on what security means Incomplete policy coverage You need A holistic approach across the whole organization Sound strategy broken down into: Policies Clear responsibilities The right technology to support this SAP AG 2004, SAP TechEd / Session ID / 6

7 The Trouble with Security How Can SAP NetWeaver Help? From Here to ESA: Securely Summary

8 SAP NetWeaver - One Open Platform Open integration and application platform that enables change SAP NetWeaver Composite Application Framework PEOPLE INTEGRATION Multi channel access Portal Collaboration INFORMATION INTEGRATION Bus. Intelligence Master Data Mgmt PROCESS INTEGRATION Integration Broker Knowledge Mgmt Business Process Mgmt APPLICATION PLATFORM J2EE ABAP DB and OS Abstraction Life Cycle Mgmt One Product Synchronized release dates One Foundation Web AS 6.40 One Package Coherent installation process One Solution Integrated IT scenarios All Apps Business Suite, partner solutions and xapps developed on NetWeaver SAP AG 2004, SAP TechEd / Session ID / 8

9 SAP NetWeaver Security Security based on industry standards Open interfaces to specialized security products Supports five key areas: Application security Secure user access Secure collaboration Infrastructure security Software lifecycle security SAP AG 2004, SAP TechEd / Session ID / 9

10 Application Security Virus scanning Segregation of duties mysap Business Suite Data protection Auditing Custom apps Partner apps Components Regulatory compliance SAP NetWeaver Platform SAP AG 2004, SAP TechEd / Session ID / 10

11 Applications with Electronic Signatures PLM ECH PLM DMS PLM PP-PI PLM QM CRM EBP Healthcare HCM Belgium Public Sector ERP SD/CRM ERP MM-FI ERP FI ERP FI/IHC SAP Content Server SAP NetWeaver SAP AG 2004, SAP TechEd / Session ID / 11

12 Integrated User Management User Management Engine SAP application SAP WebAS Central User Administration Non-SAP application Corporate directory server etc. SAP AG 2004, SAP TechEd / Session ID / 12

13 Company-Wide Single Sign-On Single Sign-On Different ERP systems Open Internet standards 3rd party Legacy SAP systems SAP EP FI FI CFM KW R/3 4.6 HR LO CRM APO 3.1H BW SEM mysap components Enterprise boundary SRM Inside Partner Outside Various Internet services SAP SAP Internet services SAP AG 2004, SAP TechEd / Session ID / 13

14 Single Sign-On Mechanisms for SAP Systems Secure Network Communications (SNC) Secure Sockets Layer (SSL) and x.509 client certificates SAP Logon Tickets Pluggable Authentication Services (PAS) Java Authentication and Authorization Service (JAAS) Security Assertion Markup Language (SAML) SAP AG 2004, SAP TechEd / Session ID / 14

15 SAP Building on Industry Standards Federation WS- SecureConversation WS-Federation WS- Authorization Policy & Trust WS-Policy WS-Trust WS-Privacy Core Security WS-Security SSO Message Security SAML X.509 Certs XCBF Kerberos XML Sig Authorization XML Enc XACML XKMS DSML SPML Transport Security SSL/TLS GSS Trust Infrastructure PKI Supported by SAP Future Work SAP AG 2004, SAP TechEd / Session ID / 15

16 Message Security with XI Availability Levels of Security Signature Data Integrity Non-Repudiation of origin Non-Repudiation of receipt Encryption Technology XI 3.0 XI protocol WS-Security (XML-Signature) XI 3.0 RNIF S/MIME Focus of future security enhancements for XI SAP AG 2004, SAP TechEd / Session ID / 16

17 Secure Network Topology Internet Outer DMZ Inner DMZ High security area Application server farm R/3 Proxies Internal workstation network SAP AG 2004, SAP TechEd / Session ID / 17 WebAS or other Webservice SRM

18 With Encrypted Communications Internet Outer DMZ SSL GSSAPI Inner DMZ High security area SSL GSSAPI SSL GSSAPI Application server farm R/3 Proxies Internal workstation network SAP AG 2004, SAP TechEd / Session ID / 18 WebAS or other Webservice SSL GSSAPI SRM

19 Monitoring Security-Relevant Events Application security SAP Host Systems Host Central monitoring SAP SAP instance Monitoring segment Non-SAP components Monitoring segment CEN HIDS NIDS HIDS HIDS Central monitoring IDS Network security SAP AG 2004, SAP TechEd / Session ID / 19

20 Software Life-Cycle Security Security is a quality characteristic of SAP solutions ITSEC E2 medium certification Re-evaluation according to Common Criteria currently underway Development and production processes have been evaluated and approved SAP is the only provider with such a high level of certification for applications SAP Security Consultant Certification SAP Security Optimization Service Coming soon: Security Bulletin Service SAP AG 2004, SAP TechEd / Session ID / 20

21 Partners Providing Trust SAP AG 2004, SAP TechEd / Session ID / 21

22 The Trouble with Security How Can SAP NetWeaver Help? From Here to ESA: Securely Summary

23 What is ESA? Enterprise Services Architecture is a service-oriented architecture for adaptive business solutions. SAP AG 2004, SAP TechEd / Session ID / 23

24 From Here to ESA: Securely value Add controls for modular business processes ue l Va SAP NetWeaver Support for modular business processes and IAM model with centralized management and decentralized enforcement Implement message security SAP XI Digitally protected business processes (SSF, XMLSig&Enc) Are you Here? Unify and integrate user authentication SAP Web AS + SAP Enterprise Portal Single sign-on: One logon to SAP EP provides access to all the information and functionality you need Consolidate user management SAP Web Application Server Connect the User Management Engine to an LDAP directory and Central User Administration for a central point of administration functionality SAP AG 2004, SAP TechEd / Session ID / 24

25 Identity Management People People Integration (Portal, Identity Mgmt,...) Process Integration (Business Process Mgmt, Exchanges,...) Web Services SAP AG 2004, SAP TechEd / Session ID / 25 Directory

26 Across Company Boundaries People People Integration Identity Federation (Portal, Identity Mgmt,...) Process Integration Web Service Security (Business Process Mgmt, Exchanges,...) Web Services Company A SAP AG 2004, SAP TechEd / Session ID / 26 Company B

27 The Trouble with Security How Can SAP NetWeaver Help? From Here to ESA: Securely Summary

28 Summary The trouble with security SAP NetWeaver can help Standards-based Strong partner network Application security Secure user access Secure collaboration Infrastructure security Software life-cycle security From here to ESA: Securely Consolidate user management Implement SSO Add controls for modular business processes SAP AG 2004, SAP TechEd / Session ID / 28

29 Further Information Public Web SAP Developer Network: SAP NetWeaver Platform Security SAP Service Marketplace: SAP Security Newsletter to SAP AG 2004, SAP TechEd / Session ID / 29

30 SAP Developer Network SAP AG 2004, SAP TechEd / Session ID / 30

31 Questions? Q&A SAP AG 2004, SAP TechEd / Session ID / 31

32 Copyright 2004 SAP AG. All Rights Reserved No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, Windows, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation. IBM, DB2, DB2 Universal Database, OS/2, Parallel Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400, iseries, pseries, xseries, zseries, z/os, AFP, Intelligent Miner, WebSphere, Netfinity, Tivoli, and Informix are trademarks or registered trademarks of IBM Corporation in the United States and/or other countries. Oracle is a registered trademark of Oracle Corporation. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc. HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. Java is a registered trademark of Sun Microsystems, Inc. JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. MaxDB is a trademark of MySQL AB, Sweden. SAP, R/3, mysap, mysap.com, xapps, xapp, SAP NetWeaver and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary. These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP AG 2004, SAP TechEd / Session ID / 32