ERP Today has established itself as THE independent voice of the enterprise technology sector through its use of dynamic journalism, creativity and purpose.
SAP customers have a responsibility when it comes to threat detection and incident response for their systems, whether their applications are running on-premise or in the cloud. These responsibilities are clearer in an on-premise environment where the customer manages secure configuration and operations including the servers on which the solution runs, databases that are in use, and the networking infrastructure. Responsibilities are less clear for cloud operations, which is why a shared responsibility model that includes privacy, compliance management, business continuity planning, and threat detection is essential. This is the case with the Shared Responsibility Model that SAP has published for RISE with SAP S/4HANA Cloud Private Edition.
A specific example is that, when an organization moves SAP workloads to the cloud, SAP manages protecting, monitoring, and responding to threats impacting the cloud infrastructure, networking, data stores, and cloud operations. These are the parts of the environment that the customer cannot access directly. Similarly, SAP has no access to the secure configuration and transactions within an application running in an on-premise infrastructure, for example, where customers are responsible for tasks like user provisioning and authorizations, business process configuration, and deciding who can access data and functionality in the system. Even for responding to tickets, SAP cannot access a customer system unless allowed.
Understanding these responsibilities is crucial for customers because unclear roles can lead to oversight of critical elements. This is particularly important because cybersecurity attacks continue to increase in volume and impact. Even if an attack doesn’t directly impact SAP systems, it may indirectly affect these systems through cross-contamination, which can force organizations to shut down SAP systems to prevent them from being impacted.
However, even with a clear understanding of roles, customers may be unsure how to proceed in the event of a cybersecurity incident. SAPinsider research has highlighted that when it comes to threat detection and incident response, organizations still need assistance. The research reveals that 37% of surveyed organizations require guidance on handling detected threats, 34% require guidance on identifying potential threats, and 33% need help understanding how to best use threat detection tools.
Organizations can address these challenges by reporting new security issues to SAP. However, what SAP can achieve will be limited by the access that they have to the system, and a security incident may exceed the expertise or capacity of in-house teams. To support organizations in addressing this, Onapsis has partnered with SAP to provide faster investigation and incident response assistance to SAP customers. Onapsis’ SAP Incident Response enables organizations to use an SAP-endorsed incident response when faced with an attack. Having access to expertise, support, and technology when managing a security incident can help hasten investigations and accelerate recovery.
Security is one of the most important topics for insiders today with, for example, 66% of organizations citing it as a key factor when choosing a cloud provider for RISE with SAP. This is because cybersecurity incidents are increasingly impacting SAP systems either directly or indirectly. Ensuring that systems are secure is top of mind for both SAP and IT organizations. But recognizing security as a priority does not equate having the capabilities or expertise to respond to a security incident. This makes solutions like Onapsis’ SAP Incident Response, a big advantage for organizations as it enables them to use the knowledge and resources that may not be available internally. Given the security challenges faced by organizations today, what should ERP users do to be prepared?
Receive weekly updates with new and exclusive content from ERP Today.
English 
Français