SAP Cloud Secure Cloud Operations

Transkript

1 SAP Cloud Secure Cloud Operations public April, 2016

2 SAP Cloud deployment model SAP Cloud Secure SAP- center SAP Center SAP Managed Operations SAP Support Hybrid Cloud Private Cloud Public Cloud On-premise 2

3 privacy vs. Cyber-security Privacy is different than Cybersecurity Protection of individuals with regard to the processing of personal data Protection of information against unauthorized access through computing environments DPO Responsible: Privacy Officer Technical and Organizational Measures (TOM) Responsible: Information Security Officer Risk: Infringement of Personal Rights Risk: Loss, Deletion, Abuse 3

4 Technical & organizational measures (TOM) at a glance Security Patch Management Malware management process Multi-tenancy Separate system landscapes Access restrictions Video and sensor surveillance Access logging Intruder alarm systems Integrity Separation Business continuity management Disaster recovery plans / testing Access Availability System Access SAP Cloud Secure Job Password policy Strong authentication Access management tool Input Segregation of duties Subcontractor compliance / certification Access Transmission Security Incident Management 24 x 7 Security Monitoring Center SIEM Authorization concepts SAP security policies and standards Security checks and penetration tests SAP Security Policy (confidentiality) Network Security Encryption 4

5 Layer of assurance Contract Processing agreement to meet applicable local data privacy regulations globally Audit & Certification Service Organization (SOC) reports and Certifications providing independent evidence for Security, Confidentiality, Availability, Protection and Quality Policies Directives Standards Integrated Management System for Information Security, Protection and Service Delivery Comprehensive Security Architecture covering Application, Processing systems and center SAP Cloud Secure 5

6 SAP Cloud secure - Contractual framework Globally applicable Processing Agreement (DPA) based on European Privacy Directive, one of the most comprehensive privacy regulation, and enhanced for local privacy regulations. Uniform application and control of this comprehensive data privacy regulation is consistent throughout the sub-processor chain. SAP observes changes of local Privacy regulation globally and invests to keep our service in a way that our customer can continue to use it in compliance. Additional cloud service offerings to cover stricter Privacy requirements and special customer demands; like storage and transfer of data in / from EU locations, only, US Federal Government environment, Australian or Russian data residency etc. 6

7 Management System of standards and best practices* Transparency Certification ISO 27001** ISO 22301**, ISO 9001** BS10012 Financial s SOC 1 (SSAE16 / ISAE 3402) Operations and Compliance SOC 2, SOC 3 (AT 101 / ISAE 3000) Privacy Protection BS ISO Privacy BDSG EU Directive 95/46/EC Security Best Practice (extract) Quality Management ISO 9000 ISO25010 Service Delivery ISO Business Continuity ISO Application Security ISO OWASP Hardening Guidelines SANs, ISO CERT, NIST Destruction of Media ISO Incident Management ISO Foundation Code of Practice ISO *) The Management systems are used across all SAP Cloud Secure services, execution of independent certification and audit depend on service and organizational unit respectively. Details available at: **) Component of the Integrated Information Security Management System (IISMS) of SAP 7

8 SAP quality management system Quality goal / perception Customer view Product validation Customer Validation Ramp-Up Customer Quality Perception Product quality Product standards Checks and tests Static code checks Quality gates Process quality Process standards Program management Architecture governance Continuous Improvement Process People enablement Quality policy Quality management system Quality goal / perception Quality strategy People development Process improvement 8

9 SAP data protection management system Legal Protection and Privacy requirements Management Standards SAP Policies & Standards Organizational specifics ISO (optional) BS 10012:2009 SAP DP Policy TOM Technical & organizational measures SAP Security Policy & Standards Protection relevant processes Protection Governance Major locations of LoB SAP DPMS SAP`s Protection Management System combines the various requirements relevant for data protection and privacy in two documents General book: General rules and descriptions valid for entire organizations LoB appendix: Definition of scope and work instructions valid for employees in this LoB 9

10 Business continuity management system Scope Cloud Continuity Disaster Recovery Support Process Natural disaster Man-made crisis (e.g. bomb threat/ attack) Political unrest, strike, war, Pandemic all other events that cannot be handled by normal problem solving within day-to-day routine business procedures IT Service Continuity Center Critical IT-Services Objectives - Enable quick decisions - Keep employees safe & sound - Conserve working environment - Keep critical processes alive - Continue operations Corporate Continuity Process Continuity Crisis Management Travel Safety & Security Goal: Respond to any disruptive incident ( all-hazard-approach ) 10

11 SAP security policy framework Policy Standard Directive Procedure Good Practice management of the topic of security, approved by the Security Steering Committee binding requirements for all employees and for specific target groups more detailed binding requirements instructions for the operative implementation advices and recommendations for implementation 11

12 Scoping Multi-dimension privacy and compliance approach Scoping Technology Processes People Cyber-security & privacy Confidentiality, Integrity, Availability Cyber-security and privacy Protection Protection of Intellectual Property Technology Processes Requirements & Measures Enforcement and Evidence Monitoring Audit People SAP Cloud leverages a holistic, multi-dimensional approach to establish and maintain state-of-the-art Privacy & Compliance. 12

13 Technical security architecture SAP Cloud Secure Segregation Intrusion Prevention Business Continuity Customer A Customer C Customer B 13

14 Center Tier Level (Availability) Definition SAP Cloud Solutions and Customer needs to be operated in a: SAP Tier Level III, III+ or IV classified Center. SAP checks on site the compliance to the SAP Center minimum physical security standard that covers topics like: Perimeter & Location security Building entry point security Building Security Access s & Monitoring General access and Access to dedicated SAP areas Fire Protection Electrical Power supply Certifications of the DC Provider Minimum availability requirements Tier I Tier II Tier III Tier III+ Tier IV Stand-alone Center building necessary no no no yes yes Amount of external electrical power suppliers Amount of transformers to power the Center n n n+1 n+1 2n UPS Battery System necessary no yes yes yes yes Minutes UPS must provide power 0 5 >10 >10 >10 Amount of UPS Systems necessary n n n+1 n+1 2n (Diesel-) Generators needed no no yes yes yes Amount of cooling systems needed n n n+1 n+1 2n Server cooling is independent from an office AC no no yes yes yes Fire detection system needs to be installed yes yes yes yes yes Fire extinguishing system must be installed no yes yes yes yes On-site response time of Center personnel <48h <8h <1h <1h <1h Available WAN network connection lines 1 n+1 n+1 n+1 2n Available LAN network connection lines n n+1 n+1 2n 2n Legend: n = all components are used for operation; no spare component; no backup or redundancy; n+1 = exactly one additional component is available to replace a failed component; 2n = every component has a backup/spare component; full redundancy 14

15 SAP Cloud Secure Segregation and intrusion prevention Internet DMZ - External Intrusion Prevention Penetration Tests 3 rd party Ethical Hacker Penetration Tests 3 rd party Ethical Hacker Security Implementation Audit & Security Reviews HDMZ - Perimeter Firewall & Router ACL Protection Center Internal Administration Network Internal Intrusion Detection Admin VPN / WTS Access & Logging Customer A Customer B Customer C IPS* Operations Multi-factor Authentication *IPS = Network Intrusion Prevention System **SMC = Security Monitoring Center (7*24) SMC** / SIEM*** ***SIEM = Security Information and Event Management 15

16 2016 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. Please see for additional trademark information and notices. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP SE or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP SE s or its affiliated companies strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forwardlooking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions. 16

17 2016 SAP SE oder ein SAP-Konzernunternehmen. Alle Rechte vorbehalten. Weitergabe und Vervielfältigung dieser Publikation oder von Teilen daraus sind, zu welchem Zweck und in welcher Form auch immer, ohne die ausdrückliche schriftliche Genehmigung durch SAP SE oder ein SAP-Konzernunternehmen nicht gestattet. SAP und andere in diesem Dokument erwähnte Produkte und Dienstleistungen von SAP sowie die dazugehörigen Logos sind Marken oder eingetragene Marken der SAP SE (oder von einem SAP-Konzernunternehmen) in Deutschland und verschiedenen anderen Ländern weltweit. Weitere Hinweise und Informationen zum Markenrecht finden Sie unter Die von SAP SE oder deren Vertriebsfirmen angebotenen Softwareprodukte können Softwarekomponenten auch anderer Softwarehersteller enthalten. Produkte können länderspezifische Unterschiede aufweisen. Die vorliegenden Unterlagen werden von der SAP SE oder einem SAP-Konzernunternehmen bereitgestellt und dienen ausschließlich zu Informationszwecken. Die SAP SE oder ihre Konzernunternehmen übernehmen keinerlei Haftung oder Gewährleistung für Fehler oder Unvollständigkeiten in dieser Publikation. Die SAP SE oder ein SAP-Konzernunternehmen steht lediglich für Produkte und Dienstleistungen nach der Maßgabe ein, die in der Vereinbarung über die jeweiligen Produkte und Dienstleistungen ausdrücklich geregelt ist. Keine der hierin enthaltenen Informationen ist als zusätzliche Garantie zu interpretieren. Insbesondere sind die SAP SE oder ihre Konzernunternehmen in keiner Weise verpflichtet, in dieser Publikation oder einer zugehörigen Präsentation dargestellte Geschäftsabläufe zu verfolgen oder hierin wiedergegebene Funktionen zu entwickeln oder zu veröffentlichen. Diese Publikation oder eine zugehörige Präsentation, die Strategie und etwaige künftige Entwicklungen, Produkte und/oder Plattformen der SAP SE oder ihrer Konzernunternehmen können von der SAP SE oder ihren Konzernunternehmen jederzeit und ohne Angabe von Gründen unangekündigt geändert werden. Die in dieser Publikation enthaltenen Informationen stellen keine Zusage, kein Versprechen und keine rechtliche Verpflichtung zur Lieferung von Material, Code oder Funktionen dar. Sämtliche vorausschauenden Aussagen unterliegen unterschiedlichen Risiken und Unsicherheiten, durch die die tatsächlichen Ergebnisse von den Erwartungen abweichen können. Die vorausschauenden Aussagen geben die Sicht zu dem Zeitpunkt wieder, zu dem sie getätigt wurden. Dem Leser wird empfohlen, diesen Aussagen kein übertriebenes Vertrauen zu schenken und sich bei Kaufentscheidungen nicht auf sie zu stützen. 17