SAP Cloud makes the difference - response to top risks in cloud business

Transcription

1 SAP Cloud makes the difference - response to top risks in cloud business SAP Cloud January 2014 Customer

2 How Security should NOT work Procedure of an ineffective team Security team works decoupled from Operations team. This leads to missing understanding and acceptance of the requirements to be implemented. Missing implementation check and regular monitoring of security implementation by Security team keeps security gaps undetected. Typical procedure driven by an ineffective security department: 1. Security team is releasing a new security standard and hands over to operational team for implementation. 2. Operations responsible reads through it and either a. has no time to implement and puts it in the drawer or b. has no clue what security wants and puts it in the drawer or c. implements the requirement but only partially. Security Operations 3. Several months later either a. Internal audit performs a review and identifies issues or b. an attacker identifies the issues, leverages the gap to steal information and makes it public 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 2

3 Why SAP Cloud is different SAP has a long-standing tradition in security of its solutions and takes demands from customers on cloud security very seriously. The key differentiator of SAP Cloud: A. B. C. D. Strong collaboration between Security, Operations and Product Development team Multi Layers of defense to protect our Customer s data in the SAP Cloud Holistic Security & Compliance approach: integrated, monitored and validated by external audits Mitigating the Risks of Cloud E. Customer can select the region of data storage 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 3

4 Why SAP Cloud is different A. Strong Collaboration Strong collaboration of Product Security team and Operations Security team ensures proper security and compliance implemented in SAP Cloud products. Identified issues are directly communicated into Product Development team to ensure immediate fixes. Strong collaboration of Security team and Operations team ensures proper definition of security requirements individually per Cloud product within the SAP Cloud. Security team consults the Operations team in defining and implementing the security measures per asset individually. Regular monitoring ensures timely identification of issues SAP AG or an SAP affiliate company. All rights reserved. Customer 4

5 Why SAP Cloud is different B. Multi Layers of Defense (1/2) Data Center White Hat Hacker Penetration Tests External Intrusion Prevention Perimeter Firewall Internal Intrusion Prevention White Hat Hacker Security Penetration Tests Implementation Audit & Security Reviews Admin VPN / WTS Access Control & Logging Customer A Data Customer B Data Customer C Data NIPS + SMC Operations Multi-factor Authentication HIPS NIPS = Network Intrusion Prevention System SMC = Security Monitoring Center (7*24) HIPS = Host Intrusion Prevention System 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 5

6 Why SAP Cloud is different B. Multi Layers of Defense (2/2) SAP Cloud Security Secure Operations / Internal Control Framework Asset Management Change Management Incident Management Anti Virus & Malware Management Backup / Restore Management Identity & Access Management Network Security Network Admission Control Intrusion Prevention Systems Network Filtering 2-factor Authentication Proxies Internet Content Filtering Advanced IT Security Architecture Isolated, separated Landscape per Customer Security hardened Systems Customer data flow control Regional Data Storage (e.g. EU-, US-Cloud) HEC Compliance Monitor (Extention to SAP Cloud in planning) Threat & Vulnerability Management Security Patch Management Penetration Testing Vulnerability Scanning 24 x 7 Security Monitoring Center Completeness & Effectiveness is regularly audited and verified by external certification and compliance audits. Secure Product Development Lifecycle Physical Security Video and Sensor Surveillance Access Logging Security Guards Fire Detection and Extinguishing System Uninterruptible Power Supply Biometric Access Control in certain Locations 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 6

7 Scoping Why SAP Cloud is different C. Holistic Security & Compliance Approach (1/2) SAP Cloud leverages a multi-dimensional security and compliance approach to establish and maintain state-of-the-art Security & Compliance. The following two slides describe the key aspects of the holistic Security & Compliance Approach. Protection Goal Security (CIA) SAP Cloud focuses on confidentiality and integrity of data as well as availability of customer systems and central infrastructure. Data Protection SAP Cloud is fully committed to data protection and privacy. SAP is a global company with its headquarters in Germany, which is a member of the European Union (EU). Therefore our Policy is based on definitions of European Data Protection legislation and defines the basic principles applicable for every SAP entity *). SAP Cloud respects data protection and privacy rights and safeguards any Personal Data of our customers. IP Protection SAP Cloud in addition focuses on the protection of your intellectual property. Access to data is strictly limited according the need-to-know-principle. Strict separation of customer systems is understood! Protection Goal Technology Processes People *) If local (i.e. country specific) or other applicable laws require stricter standards, Personal Data will be handled in accordance with those stricter laws SAP AG or an SAP affiliate company. All rights reserved. Customer 7

8 Scoping Why SAP Cloud is different C. Holistic Security & Compliance Approach (2/2) Demands & Enforcement Requirements / Measures SAP has a strict policy framework broken down to detailed technical procedures for operations. Monitoring Regular monitoring ensures timely identification of deviations and initiates fixes. Audits By Compliance & Certification Audits we ask external experts to verify our security effectiveness. By regular supplier audits we ensure security effectiveness of suppliers and sub-contractors. Protection Goal Scoping Technology Secure operability of SAP Cloud products is monitored. Issues are directly addressed to Product Development team. Our security scope covers all infrastructure components and tools required to operate and manage SAP Cloud. Processes All relevant processes for cloud product development and cloud operations are in security scope. People Regular training and check of awareness is key to ensure proper operations of SAP Cloud. Technology Processes People 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 8

9 PROBABILITY Why SAP Cloud is different D. Mitigating the risks of cloud (1/2) Top cloud risks (according ENISA) The following table shows the distribution of the risk probabilities and impacts: 2 Loss of Governance 7 Isolation Failure 2 8 Malicious Insider 9 Management Interface Compromise Insecure or Incomplete Data Deletion 14 Service Engine Compromise 19 Subpoena and e-discovery 20 Changes of jurisdiction Data Protection Risk All cloud related risks are assigned to one of the following categories: Policy and organizational risks Technical risks 18 Legal risks Legend: medium risk Top risk IMPACT 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 9

10 Why SAP Cloud is different D. Mitigating the risks of cloud (2/2) RISKS 2 Loss of Governance Service provider is in charge of security 7 Isolation Failure Customers can access data of other customers 8 Malicious Insider Employees of service provider misuse high-privileges 11 Insecure or Incomplete Data Deletion Wiping of customer data when terminating the contract 9 Management Interface Compromise Customer management interfaces of public cloud providers are Internet accessible and enable access to large sets of resources. 14 Service Engine Compromise Access to Hypervisor might enable access to all customer data 19 Subpoena and e-discovery Risk of disclosure of data to unwanted parties in the event of confiscation of physical hardware by law-enforcement agencies. 20 Changes of jurisdiction Customer data may be held in multiple jurisdictions 21 Data Protection Risk Processing data in another country might be considered unlawful by the responsible Data Protection authority. SAP MITIGATION MEASURES Security Incident Reporting to customers established Compliance dashboard for customers (currently under development) Single-tenancy at HEC Security Architecture Concept in place to secure customer landscapes (incl. customer isolation) Technical Security Validation is conducted by external experts to verify implementation of security architecture concept High-privileged generic accounts are only assigned for a defined timeframe with logging activated Internal controls are in place to govern & review the usage of high-privileged users - part of external audits Single-tenancy at HEC Decommissioning process is documented and implemented Security Architecture Concept in place to secure Hypervisor and customer management interface Technical Security Validation is conducted by external experts to verify implementation of security architecture concept Vulnerability Scans are conducted multiple times a year Penetration Tests are conducted by external party multiple times a year Single-tenancy at HEC Dedicated Databases per customer Security Incident Reporting to customers Transparency on data centers the customer data is stored Customer can choose if data should remain in one region only (US region only, EU region only) Internal Controls focusing on Data Protection established SOC 1 attestation covers proper data handling practices Security Incident Reporting to customers established 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 10

11 Why SAP Cloud is different E. Customer can select storage region A. The physical storage of customer B. The general rule is: data is crucial to numerous enterprises. Therefore, our SAP Cloud Solution customers can chose if their data is stored in Cloud data centers located in the USA or in Europe. We have clear and companywide guidelines in place that define how we respond to request for customer data coming from authorities, when it comes to law enforcement and national security concerns. We take our commitment to our customers and legal compliance very seriously. Customer data is only shared if the request is legally valid. Our legal department evaluates every inquiry in detail. In addition, we will question a request if there are grounds for assuming that they are not in conformity with the law SAP AG or an SAP affiliate company. All rights reserved. Customer 11

12 Additional Information on Security & Compliance available on request: Security Whitepaper: SAP Cloud: Focusing on security Per SAP Cloud offering: Technical Security overviews Different Certificates and Attestations

13 Thank you! Contact information: Ralph R. Salomon VP IT Security & Risk Office; CRISC Chief IT Security Officer SAP IT & HANA Enterprise Cloud SAP AG Phone: /

14 Appendix

15 Data Center Centers Security & Data Protection Requirements Data Center (Building / Facilities) Cloud hosted customer environments need to be operated in an SAP Tier Level III, III+ or IV classified Datacenter to meet the physical security and operational compliance requirements of the customer industries. For co-location data center (non-sap DC), access to SAP HEC infrastructure needs to be physically separated from other DC customers, e.g. using cages SAP AG or an SAP affiliate company. All rights reserved. Customer 15

16 Value of Service Security, Compliance & Data SAP Cloud Operations Processes: Internal Control System Certifications as of today BaaS SAP HANA Enterprise Cloud: SOC 1-3 (Type I), ISO 9001, SaaS LoB Applikationen (SF, ARIBA, ByD/ Cloud Operations): SOC 1-3, ISAE 3402, PCI, Safe Harbour * PaaS DBaaS SAP HANA Cloud Platform: ISO SAP HANA One Premium SAP HANA One Description of Certifications available on next slide IaaS Scope of Offering Legend: BaaS = Business as a Service SaaS = Software as a Service PaaS = Platform as a Service DBaaS = Database as a Service IaaS = Infrastructure as a Service * = listed certificates do only Apply for selected products 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 16

17 Security, Compliance & Data SAP Cloud Extension of certification strategy & verification of the control system Data Protection in the Cloud ISO27018 *) German (cloud specific) Standards *) e.g. BSI Grundschutz Baustein Cloud SOC 1 SOC 2 SOC 3 State-of-the-art controls for security, availability, integrity and confidentiality / data protection e.g. EU Cloud Certification EU (cloud specific) Standards *) State-of-the-art Security and Quality Management System ISO ISO9001 Further Certifications **) e.g. FDA, FISMA, PCI-DSS *) not available yet **) as required and based on Business Case 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 17

18 Basic Industry Specific Certifications Audits & SAP Cloud Attestation/ Certificate Purpose Attestation/ Certificate Purpose SOC1 / ISAE 3402 / SSAE 16 (former SAS 70) Report on a service organizations internal controls that are likely to be relevant to an audit of a customer s financial statements. PCI-DSS Required for customers: who handle cardholder information for debit, credit, prepaid, e-purse, ATM, and POS cards SOC 2 Report on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy Can be handed out to customers and prospects, use/distribution may be restricted. Safe Harbour Framework providing guidance for U.S. organizations on how to ensure adequate protection for personal data from the EU as required by the European Union's Directive on Data Protection SOC 3 Trust Services Report for Service Organizations Used for marketing purposes, unrestricted use/distribution. HIPAA Privacy regulations requiring health care providers, organizations, and their business associates, develop and follow procedures that ensure the confidentiality and security of protected health information. ISO Certification of a Information Security Management System Used for marketing purposes, certification can be officially published. FISMA / FedRAMP Required for customers: US federal agencies. Based on National Institute of Standards and Technology (NIST) SP controls America based only. ISO 9001 ISO 27018:2014 (not available yet) Certification of a Quality Management System Used for marketing purposes, certification can be officially published. Data Protection in der Cloud FDA ITAR Required for customers from Pharma, Cosmetica, Food & Drugs industries. Required for customers from Military and Defense. Separated data center in US required with certified US personnel only SAP AG or an SAP affiliate company. All rights reserved. Customer 18

19 Overview on cloud computing risks identified by ENISA 1/4 # Policy and organizational risks SAP mitigation measures 1 Lock-in Onboarding as well as decommissioning processes are documented and implemented 2 Loss of governance Security Incident Reporting to customers Compliance dashboard for customers (currently under development) 3 Supply Chain Failure Supplier Management Process to ensure compliance to SAP standards Transparency for customers with regards to data centers they are hosted in SOC 2 audit requires transparency on supply chain as well 4 Conflicts between customer hardening procedures and cloud environment IT Security Hardening Guidelines for HEC operations BMC security configuration checks on cloud infrastructure Contract framework including SLA 5 Social engineering attacks Security Awareness Trainings (special focus on social engineering/phishing) Security Monitoring Center 7*24 Dataflow analyzer / sandboxing tool in evaluation # Technical risks SAP mitigation measures 6 Resource exhaustion (under or over provisioning) Capacity Planning Workforce Management 7 Isolation failure Security Architecture Concept Technical Security Validation Single-tenancy at HEC 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 19

20 Overview on cloud computing risks identified by ENISA 2/4 # Technical risks SAP mitigation measures 8 Cloud provider malicious insider - abuse of high privilege roles 9 Management interface compromise (manipulation, availability of infrastructure) High-privileges are only assigned for a defined timeframe Internal controls are in place to govern & review the usage of high-privileges users - part of external audits Technical Security Validation Vulnerability Scans Penetration Tests 10 Intercepting data in transit Security Architecture Concept Encrypted communication line between customer and SAP (VPN/ MPLS) System Monitoring process Security Monitoring Center 7*24 Secure physical shipping process for customer data (if needed) 11 Insecure or ineffective deletion of data Decommissioning process No multi-tenancy at HEC Secure deletion of customer data 12 Distributed denial of service (DDoS) Technical Security Validation Vulnerability Scanning 13 Economic denial of service (EDoS) Penetration Testing SAP CERT (Computer Emergency Response Team) SAP SMC (Security Monitoring Center) IPS (Intrusion Prevention System) 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 20

21 Overview on cloud computing risks identified by ENISA 3/4 # Technical risks SAP mitigation measures 14 Compromise of Service Engine Security Architecture Concept Technical Security Validation Vulnerability Scanning Penetration Testing External SOC audits 15 Loss of Cryptographic Keys Hardware Security Modules implemented Private Key Infrastructure (PKI) change management process implemented 16 Non Cloud-Specific Network-Related Technical Failures or Attacks IT Security Hardening Guidelines for HEC operations BMC security configuration checks on cloud infrastructure Security Monitoring Center 7*24 Technical Availability Monitoring 7*24 17 Loss of Backups All Data Centers (DC) have security tier level III or higher Backups are performed to another DC location in the same region Backup process and Procedures are in place including adequate controls to protect backups Process and control verification are in scope of external audits 18 Natural disasters DC selection criteria exclude DC in risk areas/dc without adequate protection Business Continuity Process and Procedures are in place including adequate controls Process and control verification are in scope of external audits 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 21

22 Overview on cloud computing risks identified by ENISA 4/4 # Legal risks SAP mitigation measures 19 Subpoena and e-discovery Private cloud deployment for each customer Security Incident Reporting to customers SAP Security Monitoring Center 20 Risk from changes of jurisdiction Transparency on data centers the customer data is stored. The customer can choose if data should remain in one region only (e.g. US region only, EU region only). Regular risk assessments for high-risk locations (data center) HEC hosted in customer location service model currently under investigation 21 Data protection risks ISO certification for HEC covers data protection aspects SOC 1 audit covers data handling practices at HEC Security Incident Reporting to customers regional (e.g. EU-only) operation model currently under investigation 22 Licensing Issues Individual contract regulations - hardware is not shared 23 Intellectual Property Issues ISO certification for HEC covers IP protection aspects SOC 1 & 2 audit covers data handling practices at HEC Security Incident Reporting to customers 2014 SAP AG or an SAP affiliate company. All rights reserved. Customer 22

23 2014 SAP AG or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG or an SAP affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG (or an SAP affiliate company) in Germany and other countries. Please see for additional trademark information and notices. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP AG or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP AG or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP AG or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. In particular, SAP AG or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP AG s or its affiliated companies strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP AG or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forwardlooking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions SAP AG or an SAP affiliate company. All rights reserved. Customer 23

24 2014 SAP AG oder ein SAP-Konzernunternehmen. Alle Rechte vorbehalten. Weitergabe und Vervielfältigung dieser Publikation oder von Teilen daraus sind, zu welchem Zweck und in welcher Form auch immer, ohne die ausdrückliche schriftliche Genehmigung durch SAP AG oder ein SAP-Konzernunternehmen nicht gestattet. SAP und andere in diesem Dokument erwähnte Produkte und Dienstleistungen von SAP sowie die dazugehörigen Logos sind Marken oder eingetragene Marken der SAP AG (oder von einem SAP-Konzernunternehmen) in Deutschland und verschiedenen anderen Ländern weltweit. Weitere Hinweise und Informationen zum Markenrecht finden Sie unter Die von SAP AG oder deren Vertriebsfirmen angebotenen Softwareprodukte können Softwarekomponenten auch anderer Softwarehersteller enthalten. Produkte können länderspezifische Unterschiede aufweisen. Die vorliegenden Unterlagen werden von der SAP AG oder einem SAP-Konzernunternehmen bereitgestellt und dienen ausschließlich zu Informationszwecken. Die SAP AG oder ihre Konzernunternehmen übernehmen keinerlei Haftung oder Gewährleistung für Fehler oder Unvollständigkeiten in dieser Publikation. Die SAP AG oder ein SAP-Konzernunternehmen steht lediglich für Produkte und Dienstleistungen nach der Maßgabe ein, die in der Vereinbarung über die jeweiligen Produkte und Dienstleistungen ausdrücklich geregelt ist. Keine der hierin enthaltenen Informationen ist als zusätzliche Garantie zu interpretieren. Insbesondere sind die SAP AG oder ihre Konzernunternehmen in keiner Weise verpflichtet, in dieser Publikation oder einer zugehörigen Präsentation dargestellte Geschäftsabläufe zu verfolgen oder hierin wiedergegebene Funktionen zu entwickeln oder zu veröffentlichen. Diese Publikation oder eine zugehörige Präsentation, die Strategie und etwaige künftige Entwicklungen, Produkte und/oder Plattformen der SAP AG oder ihrer Konzernunternehmen können von der SAP AG oder ihren Konzernunternehmen jederzeit und ohne Angabe von Gründen unangekündigt geändert werden. Die in dieser Publikation enthaltenen Informationen stellen keine Zusage, kein Versprechen und keine rechtliche Verpflichtung zur Lieferung von Material, Code oder Funktionen dar. Sämtliche vorausschauenden Aussagen unterliegen unterschiedlichen Risiken und Unsicherheiten, durch die die tatsächlichen Ergebnisse von den Erwartungen abweichen können. Die vorausschauenden Aussagen geben die Sicht zu dem Zeitpunkt wieder, zu dem sie getätigt wurden. Dem Leser wird empfohlen, diesen Aussagen kein übertriebenes Vertrauen zu schenken und sich bei Kaufentscheidungen nicht auf sie zu stützen SAP AG or an SAP affiliate company. All rights reserved. Customer 24