Zane Wilson, Senior Vice President, SAP Architecture EMEA, Lemongrass, talks about bringing the concept of shared responsibility to cloud security.
As organizations continue to embrace cloud computing, the adoption of public cloud platforms for mission-critical applications like SAP is steadily increasing.
Driven by the potential for cost savings, scalability, and speed, organizations are increasingly migrating their SAP workloads to the cloud. However, this migration presents new security challenges that must be addressed proactively.
One of the core concepts in cloud security is the shared responsibility model, which defines the roles and responsibilities of the cloud provider and customer in securing the cloud environment. While the cloud provider is responsible for securing the underlying infrastructure, the customer is responsible for securing its applications and data and adhering to compliance requirements. Failure to understand and address the risks associated with this shared model could lead to security vulnerabilities, data breaches, and potential regulatory violations.
Understand the shared responsibility model
In the public cloud, the shared responsibility model is a critical framework that defines the division of security duties between the cloud provider and the customer. The cloud provider is responsible for securing the physical infrastructure, including data centers, servers, network equipment, and the virtualization (supervisor) layer. On the other hand, the customer is responsible for securing operating systems, applications, data, and access controls within the cloud environment. This includes configuring firewalls, installing security updates, implementing access controls, and ensuring compliance with relevant regulations.
The shared responsibility model is also divided between the customer and its systems integration (SI) partner. The SI may be responsible for managing certain aspects of the cloud environment, such as application deployment and configuration, while the customer retains overall responsibility for security and compliance for its SAP systems.
Risks associated with the shared liability model
While the shared responsibility model offers benefits, it also presents several risks that organizations must address:
Misunderstanding or overlooking responsibilities: Lack of a clear understanding of responsibilities by either party can lead to security gaps and potential vulnerabilities. Misconfiguration and Vulnerabilities: Improperly configured security settings, access controls, or network configurations can expose sensitive data and systems to unauthorized access or attacks. Compliance and Regulatory Challenges: Ensuring compliance with industry regulations and data protection laws can be a challenge when hosting data and workloads on public cloud infrastructure. Lack of visibility and control: Customers may have limited visibility and control over the underlying infrastructure, making it difficult to effectively monitor and respond to security incidents. Human error and social engineering: Unintended misconfigurations, inadequate access controls, and susceptibility to social engineering attacks can expose cloud environments to significant risks.
Real world examples
Many organizations have encountered security challenges when migrating their SAP systems to the public cloud, highlighting the importance of proactively addressing the risks associated with a shared responsibility model:
Organization A, a large manufacturing company, moved its SAP ERP system to a public cloud platform without clearly defining security responsibilities and implementing robust access controls. This resulted in a security breach where an unauthorized user gained access to sensitive financial data, resulting in significant financial losses and regulatory fines. Organization B, a healthcare service provider, has successfully secured its SAP systems on the public cloud by implementing a comprehensive security strategy. They clearly defined roles and responsibilities, encrypted all sensitive data, implemented centralized identity and access management, and conducted regular security audits and assessments. This approach has helped them maintain compliance with industry regulations and avoid data breaches. Organization C was migrating its assets to SAP RISE, when a customer technician discovered that a firewall rule error had been made, briefly exposing its RISE development environment to the public Internet. Fortunately, this issue was discovered and addressed before the production systems were exposed.
Strategies to reduce and mitigate risks
To effectively mitigate the risks associated with SAP's shared responsibility model on the public cloud, organizations should implement the following strategies:
Clearly define roles and responsibilities: Create a clear understanding of stakeholder responsibilities: cloud provider, customer, system integrator (if applicable) Implement strong access controls and identity management: Implement strong access controls, multi-factor authentication, centralized identity and access management solutions Data encryption at rest and in transit: Encrypt sensitive data At rest (data in storage) and in transit (data in motion) using industry-standard encryption protocols Monitor and record security events: Implement robust monitoring and logging mechanisms and review them regularly to detect and respond to security incidents immediately Automate security processes and configurations: Leverage automation tools and not People to apply security configurations, updates, and patches consistently across the environment. Implement cloud security posture management (CSPM) tools: These help organizations maintain visibility and control of their business. Cloud security posture, identifying misconfigurations, excessive permissions, and compliance violations. Foster a culture of security awareness: Prioritize security awareness training, implement strict access management policies, and cultivate a culture of vigilance to mitigate human vulnerabilities. Continuously improve and adapt: ​​Regularly review and update security practices, stay on top of the latest threats and mitigation strategies and foster a mindset of continuous improvement and adaptation.
Best practices for securing SAP on the public cloud
In addition to the above strategies, organizations should consider the following best practices to ensure the secure operation of SAP systems on public cloud platforms:
Follow industry standards and guidelines: Align security practices with industry standards and guidelines, such as the Cloud Security Alliance (CSA) Cloud Control Matrix, Center for Internet Security (CIS) standards, and SAP's security guidelines. Adopt a security-first mindset: Embed security considerations into every stage of cloud migrations and application development. Provide ongoing training and awareness: Provide regular security training to IT teams and end users to ensure they understand and follow secure practices. Stay informed of security updates and patches: Regularly. Monitor and apply security updates, patches, and hotfixes provided by the cloud provider, SAP, and others to address known vulnerabilities. Implement defense in depth: Adopt a multi-layered approach to security by implementing multiple layers of protection, including firewalls, intrusion detection/prevention systems, and SIEM solutions Regularly audit and evaluate: Conduct regular security audits, penetration testing, and risk assessments to address potential vulnerabilities and configurations Mistakes and areas for improvement. Collaboration and Knowledge Sharing: Foster collaboration and knowledge sharing within the organization and with industry peers, security researchers and experts. To stay up to date on the latest security trends and best practices
Where does SAP RISE fit in?
RISE is SAP's latest version of hosted private clouds built on the HEC model with AWS, Azure, or GCP cloud infrastructure and a layer of SAP-managed services on top. Here, SAP acts like any other service provider offering build, migration, and management services in addition to general Cloud IaaS. All the same risks are there, but the customer is kept at a greater distance.
You may see the security of the RISE platform as SAP's problem, not yours, but you need to remain proactive in ensuring that the deployment you receive from RISE is secure, penetration tested and properly configured. It is your responsibility to ensure that SAP remains prepared and demonstrates that they are running a high security ship.
In conclusion, securing SAP systems on public cloud platforms requires a comprehensive approach that addresses the unique challenges of the shared responsibility model. By clearly defining roles and responsibilities, implementing robust security controls, continuous monitoring and auditing, and adhering to industry best practices, organizations can effectively mitigate risks and leverage the benefits of running SAP workloads on the public cloud.
Click below to share this article
