S/4 HANA Security: The Basics and 4 Critical Best Practices

What is SAP S/4HANA?

SAP S/4HANA is an enterprise resource planning (ERP) software suite for businesses based on SAP HANA, an in-memory database. It helps organizations perform real-time business data analysis and execute transactions. SAP calls the S/4HANA-based business approach an intelligent enterprise. It is the digital core of the SAP strategy to enable businesses to carry out digital transformation processes, which also makes S4 HANA security critical for business continuity. Broadly defined, digital transformation involves modifying a company’s existing business model and work processes and models or establishing new ones. It gives companies more flexibility, responsiveness, and resilience to changing business needs, customer requirements, and external conditions.

Security Considerations for SAP S/4HANA

In terms of security, SAP S/4HANA appears to work as a conventional ERP suite that runs on the SAP HANA database. At the core of SAP S/4HANA is SAP NetWeaver AS ABAP, so it has all the same standard optimization options, switches, security controls, and customizations as other systems based on SAP NetWeaver AS ABAP.

However, in reality, security requires more than simply investigating the SAP HANA database in your SAP S/4HANA implementation. In this context, SAP HANA is not only the database but also the application server. It has native support for application processes, which run from application services extended by SAP HANA. SAP HANA-native applications can bypass the ABAP code stack and security controls, which you must address.

SAP S/4HANA can also highly simplify processes via optimized SAP Fiori applications and the SAP cockpit, the application management interface. This setup replaces the traditional transactions in SAP Business Suite.

With more businesses shifting to web-based operations, there is a need to provide access to ERP applications to external users. For example, you may let your vendor enter its numbers directly into your system to make business more efficient. However, opening up access to your ERP functions could undermine your underlying network security infrastructure.

Many organizations are already running business processes in the cloud—SAP S/4HANA offers various solutions to integrate with cloud-based processes in a hybrid environment. This setup implies that critical security data exists off-premises, so security teams must closely monitor the integration of external applications and systems. It is also important to coordinate access to each application and instance—this is where a centralized, efficient user authentication management system becomes useful.

The main factors to consider to ensure security in SAP S/4HANA include:

• Database security—the HANA database is an inherent part of the solution, so securing and authorizing database access is as important as application security.
• Increased attack surface—SAP Fiori enables omnichannel interaction across many devices, with users accessing the application from multiple access points, increasing the attack surface for potential threats. Learn more in our guide to S/4HANA Fiori
• Higher impact risk—S/4HANA systems contain a large amount of information because they serve as a unifying digital platform. The presence of critical information means that the potential impact of a successful breach is severe. Restricting user access to SAP applications is not enough to protect your system, but you need to apply role-based authorization to enhance your SAP security.
• Standard template risks—S/4HANA’s template roles often include an inherent compliance risk and segregation of duties (SoD), so you should not expect them to be clean.
• Configuration overhead—a typical SAP S/4HANA project requires extensive updates and reengineering of business processes. You may need to apply many changes to your organization’s roles, job functions, and permissions.
• Risk assessment—standard transactions are a secondary method for performing functions in an S/4HANA project, so you cannot rely on S_TCODE to fully understand the user access risk landscape.

4 Critical Best Practices for Securing SAP S/4HANA

After you migrate SAP HANA ERP Suite to S/4HANA, you need to consider how you might enhance your S/4HANA implementation’s security.

1. Upgrade Your Roles and Authorizations

The first step in securing SAP S/4HANA is to update your organization’s roles and authorizations. Check your authorization objects to protect your business functions and data from unauthorized checks. Review old transactions (this may take a while) to help make the role/authorization updates easier.

SAP S/4HANA contains SAP Fiori applications, typically web services that authorized users can use. Configure authorizations and ensure the new roles match the S/4HANA design changes. Users without Fiori experience may find it difficult, so the security team must have a comprehensive view of the work procedures for building roles.

2. Strengthen Your Security Infrastructure

Digital transformation provides opportunities for innovating and customizing services to improve customer experience. Combining SAP and blockchain technology makes transactions simpler and more secure, enabling real-time payment processing. SAP Fiori also makes it easier for external users to access business apps and publish apps to different groups or devices.

S/4HANA secures access to business-critical components, ensuring users can access the right apps by enforcing security controls like multi-factor authentication. The SAP Gateway should be a Demilitarized Zone (DMZ) to increase internal security. Administrators must secure data transmissions via standard processes such as TLS and protect the network where RFC or HTTPS connections use reverse invocations to cross zones.

3. Implement SAP Cloud Applications

SAP lets you avoid granting access to external users for your on-prem applications. Using cloud solutions to enable user interaction is a more secure option. You can use SAP Cloud Platform and Cloud Connector to exchange information and link your on-premise system to your SAP cloud apps.

If you have hybrid business processes, the security team should implement S/4HANA in the cloud and on-premises. You can use SAP’s Platform Identity Provisioning and Cloud Platform Identity Authentication to provide cloud application permissions. Compare the Cloud Connector setup with Web Dispatcher and SAP router installations.

4. Manage User Access and Authentication

Coordinating multiple access types in a digital environment can be challenging. You need to configure users natively and in S/4HANA to provide SAP Gateway access, which helps streamline data transfers between different systems. Knowledge of SAML and federated SSO (single sign-on) is useful for ensuring the security of your SAP S/4HANA system. It will allow you to build an identity management system to help track user accounts.

You should also create a central user administration system to manage SAP S/4HANA and SAP Gateway from the same place, although cloud users can be separate. Ensure you choose the right technologies when migrating to SAP S/4HANA.

S4 HANA Security with Pathlock

Moving to S4 HANA can be a massive undertaking that requires careful planning and preparation. Far too often, companies forget to think about how their access control and security strategies will change until they are getting close to going live on a new platform. S4 HANA will often require a new approach to access control that can adapt to the new landscape and challenges.

With Pathlock, organizations using SAP S4 HANA can automate many of their SAP security processes to provide 360-degree protection across the SAP system landscape. The Pathlock platform can provide complete capabilities, including:

Financial Impact Prioritization

Pathlock automatically prioritizes your most critical violations by quantifying access risk by tying violations to real dollar amounts of the out-of-policy transactions.

Comprehensive Rulebook

With Pathlock’s catalog of over 500+ rules, Pathlock can provide out-of-the-box coverage for controls related to SOX, GDPR, CCPA, HIPAA, NIST, and other leading compliance frameworks.

Real-time Access Mitigation

Pathlock allows users to quickly investigate and respond to potential risky transactions by reviewing access, de-provisioning users, forcing 2FA, or even allowing Pathlock to respond intelligently in real-time, terminating suspicious sessions and blocking transactions in real-time.

Out-of-the-Box Integrations

Pathlock’s out-of-the-box integrations extend workflows to the provisioning and service desk tools you already have in place, such as ServiceNow, SailPoint, Okta, Azure AD, SAP GRC, and more.

Lateral SOD Correlation

All entitlements and roles are correlated across a user’s behavior, consolidating activities and translating cross-application SODs between financially relevant applications.

Continuous Control Monitoring

Pathlock identifies the largest risks by monitoring 100% of financial transactions from applications like SAP in real-time, surfacing violations for remediation and investigation.

Interested to find out how Pathlock can help to automate your SAP Security program while keeping your landscape secure and compliant? Request a demo of Pathlock today!