Securing Your Digital Transformation: Cybersecurity and You

PUBLIC
Lakshmi Hanspal, Chief Security Officer, SAP Ariba Trust Office (SAP)
Gonzalo Bas, Business Security Specialist, SAP Ariba Trust Office (SAP)
June 2017
Securing Your Digital Transformation:
Cybersecurity and You

2PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
Smart SecureSimple

Decision makers today have two fundamental choices to address their
business need
Business need
Source globally, digitalize
collaboration, execute
business transactions
efficiently
Choice
Traditional application
 Deploy application on-premise or in-house
 Use phone/e-mail/letters/meetings to collaborate
 Send and receive documents via e-mail/fax/paper/EDI
 Leverage out-of-band channels for invoicing and payments
Networked solution
 Deploy application in cloud
 Invite partners to collaborate throughout the process
 Exchange documents electronically through business network
 Leverage integrated channels and achieve transparency in
invoicing and payments

A network approach is attractive, but companies need to protect their data
and their business relationships
Protect personal data
 Achieve legal compliance such as fulfilling data
protection requirements
 Ensure information relating to individuals is
protected in storage and processing
Protect trade secrets
 Store business data safely
 Transmit transactional data securely
 Prohibit unauthorized access to data

 Securing the software development lifecycle
 Guarding your data against internal and external risks
 Access through least privilege/“need-to-know basis”
 Environment segmentation and demarcation
 Resiliency as core competency
 High availability, monitoring, and business continuity
Trust model for cloud providers
Cloud providers should leverage a holistic, multidimensional approach to establish and
maintain state-of-the-art security and privacy.
Security and privacy
Technology
Processes
People
Scoping

Protecting commerce in the cloud – build secure, run secure, be secure
Business
enablement
 Customer collaterals
 Contracts and RFPs
 Trend analysis
Privacy
 Data protection
 Regulations
 Incident response
Governance
 Policies and standards
 Compliance and audit
 Risk management
 Training and awareness
Ecosystem
 Application
 Data
 Secure development
 Pen testing
 Solution integration
Architecture
and
engineering
 Solution architecture
 Infrastructure and network
 Security engineering
 Tools engineering
Security
operations
 Vulnerability management
 Incident management and response
 Event correlation
 Emerging threats

SAP Ariba secure software development to holistically integrate secure development principles in
accordance with ISO 27034-1
Build secure products – SAP Ariba secure development lifecycle
1
Security
validation
Security
response
Secure
develop-
ment
Security
testing
Risk
assess-
ment
Security
planning
Security
training
2 3 4 5 6 7
Integrate DeployCode PackageDesign

Build secure products – security training
Information
security fundamentals
Payment Card
Industry (PCI-DSS)
basics
Secure
programming
(OWASP Top 10)
Data protection
and privacy
Coming in 2017
Security expert
curriculum
Coming in 2017

Build secure products –
Software Security Champion program
 Minimum 3 to 5 years of software
development experience
 Passion for security, “thinks like a
hacker”
 Willingness to take additional security
training
 Rotation every 6 months between
primary and backup
 Role activities should link to 10%–15%
of the person’s goals
 Enforce the SAP Ariba secure
development lifecycle
 Become the static and dynamic tools
expert on your team
 Be the advocate for security within your
core development team
 Conduct architecture security analysis
and threat modeling sessions
 Attend monthly meetings with larger
Security Champion/Product Security
team
 Share gained security knowledge with
other developers
 Act as the eyes and ears of the Product
Security team
Responsibilities RoleRequirements

Run secure – security risk assessment
 Third-party vendor review
 Data privacy impact assessment
 Product security early engagement
questionnaire
 Privacy and legal review
 Threat modeling
 Product risk profile report
 Completed engagement questionnaire
 Completed privacy impact assessment
 Certification requirements
 List of third-party software
 List of applicable laws and regulations
 Business software requirements
 Data flow diagrams
 Threat modeling reports
 Risk matrix for threats
 Risk mitigation plan
 Threat profile report
Activities Deliverables

Run secure – vendor/subprocessor oversight
SAP Ariba Cloud Unit to identify
all vendors or subprocessors with
access to sensitive personal,
business, or confidential
information via production
environment.
SAP Ariba Cloud Unit to identify
all vendors or subprocessors with
access to sensitive personal,
business, or confidential
information via production
environment.
Update list when new vendors or
subprocessors are contracted.
Revaluate vendors and
subprocessors based upon
associated risk ratings or at the
time of contract renewal.
Identify Evaluate Maintain

Run secure – third-party risk assessments
SA01 Has your site been audited by an outside agency (SysTrust, WebTrust, PCI-DSS,
SAS-70 Type II, BS7799, ISO or other)?
If so, how often do you get audited?
Provide audit report(s)
SA02 Do you perform internal audits?
If so, who conducts them and how often?
Provide audit report(s).
PP01 Does an Information Security Policy/Plan exist?
If so, please provide a copy.
PP02 Who is responsible for maintaining and enforcing this policy/plan?
PP03 Does an information classification and protection policy exist?
Security assessments
Policy and procedures
PS01 What is the location of the data center?
PS02 How is access to the building controlled?
PS03 Are any areas of the building open to the public?
PS04 Is there a 24x7 guard presence on site?
PS05 Do surveillance cameras monitor the building entrances and emergency exits?
PS06 Do surveillance cameras monitor other areas of the data center?
PS07 Describe the type of surveillance cameras used (CCTV, network cameras, etc.).
PS08 What type of authentication method is used for access to the building?
PS09 What type of authentication method is used for access to the data center?
PS10 Are staff required to wear photo identification badges at all times?
PS11 Are bags, boxes and other packages inspected prior to being permitted in the facility?
PS12 What work-around methods exist for access to the buildings in the event the above access methods fail?
PS13 Are guests/visitors permitted into the data center?
If so, what is the procedure for identification and authorization?
PS14 Are guests/visitors allowed unescorted access to any portion of the building?
PS15 What other physical security controls are in place for entrance into the data center?
PS16 Are systems in the data center protected by a cage to prevent unauthorized tampering?
PS17 Is the building shared with other tenants?
PS18 What controls are in place for receiving deliveries destined for the data center?
PS19 What controls are in place for the removal of equipment from the data center?
PS20 How many personnel have physical access to the systems?
Provide role of these individuals.
Physical security controls
Environmental controls
EC01 What type of fire suppression is used within the data center?
EC02 What type of fire detection is used within the data center?
EC03 How is temperature and humidity monitored and controlled in the data center?
EC04 Are there redundant power supplies?
EC05 Are backup generators present to protect against long-term power failure?
If so, how long can operations be sustained on backup generators before refueling?
Do you have contracts for fuel supply in the event of an emergency?
EC06 Can building environmental systems be managed remotely?
IR01 Is there a Computer Security Incident Response Team (CSIRT) and plan in place?
IR02 Is the CSIRT plan tested on a regular basis?
If so, give the last date the plan was tested?
IR03 Do you have a policy for customer notification of security incidents?
IR04 Describe the process for notifying customers in the event of a security incident?
IR05 What intrusion detection systems are currently in place?
IR06 How are alerts received and managed?
IR07 Have you had any successful attempts to compromise a system?
Any failed attempts?
IR08 How do you currently protect against denial of service attacks?
IR09 Do you conduct penetration testing of your environment on a regular basis?
IR10 Are IDS and firewall logs monitored and reviewed?
How often?
How long are IDS and firewall logs maintained?
Incident response

Run secure – third-party risk assessments
DR01 Is there a disaster recovery plan in place?
DR02 What are your procedures for updating the plan?
DR03 What is the schedule for testing and training on the plan?
DR04 When was the last drill performed?
DR05 What critical systems are covered by the plan?
DR06 What systems are not covered by the plan?
DR07 What are the procedures for activating the plan?
DR08 How are inventories of critical systems maintained?
DR09 Are there formal backup procedures documented?
DR10 Describe your backup policy?
DR11 Do you have an offsite storage agreement in place?
If so, with whom?
DR12 Who has access to the backup tapes?
DR13 Is your site insured?
If so, with whom and describe the coverage.
LA01 Please describe your administrative/super user login procedures?
LA02 How is password security managed?
LA03 Please describe your password policy?
What is the minimum number of characters?
What level of complexity is required (letters, numbers, symbols, etc.)?
What is the password history?
How often must passwords be changed?
LA04 How are passwords stored and transmitted?
LA05 How are passwords communicated to users?
LA06 Do your systems support a lockout mechanism for failed login attempts?
If so, please describe.
LA07 Do you use a 2-factor authentication mechanism?
LA08 Is user access controlled by groups or roles?
LA09 Do procedures exist to disable access for terminated users?
LA10 Is there a procedure to periodically audit user accounts?
LA11 Are changes in user account privileges logged?
LA12 Do you have separation of duties when it comes to administrative access to your systems?
Logical access controls
Risk management controls
RM01 Is there a documented risk management plan with written procedures?
RM02 How often are risk assessments performed?
RM03 Please describe your risk assessment process?
OS01 Do you have 24x7 support? Please describe the escalation path. Is a live person
available at all hours?
OS02 How do you monitor your environment?
OS03 Describe your policy for delivering post mortem details after an outage.
OS04 Do you have multiple internet providers?
OS05 What are the terms of your SLA?
How do you measure your performance against it?
OS06 What are your maintenance windows?
OS07 Describe your procedures for notifying customers of downtime, both planned and
unplanned.
OS08 Do you support an encrypted interface with your systems like SSL?
OS09 Do you provide an online management tool for our account?
OS10 Please describe the technical capabilities of the on call staff.
Operational support
Disaster recovery controls

Run secure – advanced secure protocol and ciphers
Note: The front-door servers with the advanced configuration will be accessed with different URLs than the Web servers with the legacy
security configuration.
Users
Client connections from:
 Browsers
 System interfaces
Includes:
 Buyers
 Suppliers
 On-premise to Ariba
Network
DMZ network Private network
Front-door Web servers
with the
legacy
security configuration
Front-door Web servers
with the
advanced
security configuration
SAP Ariba
on-demand
products and
services
Includes:
 Upstream
 Downstream
 Ariba Network
Firewall
Firewall

Run secure – EU General Data Protection Regulation (GDPR)
Replaces EU Data Protection Directive (1995) and harmonizes data privacy laws across Europe
Requirement Implementation
 Transparency and accountability (Articles 5, 24, 30)
 Privacy impact assessment (Article 35)
 Data inventory (classification) and documentation (data flow;
encryption, anonymization, access control, edit/ read log etc.) For
products and services processing customer data
 Gap analysis, mitigation and noncompliance risk
 Privacy by design/ impact assessment
 Data portability (30 days)/ deletion/ retention
 Data breach (72 hr) involvement from DPA/ EDPB/individual
 Subprocessor process and inventory (classification)
 Privacy statement and Web site (consent for collecting PII; for
example, asgeo/IP address, noninteractively, cookie inventory,
method of tracking and messaging)
 Training and communications
 Certification – SSAE 16 SOC 2 Privacy, ISO 27018 (needs 27001)
 Record of processing activities (Article 30)
 Data protection by design and default (Article 25)
 Special categories – enhancement (Article 9)
 Automated decision taking and profiling (Article 22)
 Data subject rights (Articles 15, 17, 20)
 Data breaches and notification (Articles 33, 34)
 Using service providers (Article 28)
 Data subject rights (Articles 15, 17, 20)
 Information notices (Articles 12, 13, 14)
 Consent (Articles 4, 6, 7, 8, 9)
Prep Analysis & design Legal requirements: GDPR implementation
Jul Aug Sep Oct Nov Dec Q1/Q2
2016 2017 2018
May 25:
GDPR effective
GDPR
compliance checks

Be secure – protecting commerce in the cloud
2016 2017 2018
Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4
Upgrade legacy to SHA-2 compliance Q1 2017
Ariba Network encryption Q2 2017
Key management – software vault Q3 2017
Customer adoptionAdvanced front door Q4 2016
Customer adoptionQ4 2016Downstream data encryption
Q2 2016
Upstream
data encryption
Customer adoption
Key management – hardware vault (HSM) Q4 2017

 Corporate decisions on how risk must be managed (strategy, principles, policies, standards. …)
 Knowing how much risk the organization is willing to accept (risk tolerance/appetite)
 An understanding of who accepts risk on behalf of the organization (understanding and adherence)
 A method or process to understand the risk and how to deal with it (risk assessments, risk treatment)
 Knowing what needs to be protected (inventory, information classification)
 A method to effectively communicate responsibilities and obligations (escalate risks and decisions)
 A comprehensive and balanced set of requirements
 A method and process for managing everyone’s expectations (sign-off)
 A common framework to put it all together.
Be secure – effective risk management
Information security needs to be a continuously operating management system

Data
breach
Policy and
compliance
Third
party
App
compromise
Cyber
attacks
Infrastructure
breach
 Encryption (disk, application)
 Access control
 Data leakage protection (DLP)
 Deletion
 SIEM/event detection
 Vulnerability assessment/scans
 Threat intel
 Containment capability
 Event response
Be secure – risk categories and controls
 Subprocessor data center audit findings
 Third-party MDPA/DPQ outliers
 Third-party information system security
 Review outliers
 Audit findings
 Policy/procedure
adherence/gaps
 Policy exceptions
 Training and awareness
 SDLC
 Penetration testing
 Encryption between tiers
 Physical security
 Access management
 Configuration management
 Patching
 Asset management

Be secure – building assurance via attestation
Code of practice
ISO 27002
Transparency
Service
delivery
ISO 20000
Business
continuity
ISO 22300
Application
security
ISO 27034
OWASP
Hardening
guidelines
CIS, RAPID7,
SANs, ISO
CERT, NIST
Quality
management
ISO 9000
ISO25010
Destruction
of media
ISO 27040
Incident
management
ISO 27035
Data protection
Safe Harbor
BS 10012
Data privacy
BDSG
EU Directive 95/46/EC; GDPR
Certification
ISO 22301, ISO 9001, ISO27001,
ISO 27018
Operations and
compliance (including IP)
SOC 2, SOC 3
(AT 101 / ISAE 3000), IRAP
Financial controls
SOX, SOC 1
(SSAE16 / ISAE 3402), PCI
Privacy
Security
best
practice
Foundation

Be secure – protecting customer personal and business data
 Validating security and privacy practices and providing confidence in the use of third parties
 Approach consistent with other cloud companies
Building and
maintaining trust
 Demonstration of proactive compliance with regulators
 Common framework for other standards, regulatory requirements
 Reduced liability risk
Compliance and
legal requirements
 Management accountable for committing (time, effort, funding, resources, and more) to data
protection
 Management accountable to select controls based on risk acceptance and enforce those controls
within the organization
Management
commitment
 Increased awareness of data protection within the organization
 Appropriate protection of cloud assets
 Efficiencies gained through repeatable processes for compliance monitoring; effectiveness of
controls measured and reported
Continual
improvement

In case
 You accidently send your data to the wrong recipient
 Your coworker notifies you of e-mailing sensitive data to the wrong recipient
 You notice a security issue in an application that may expose your data to others
 You are not sure if there is a security issue, but believe there could be one
Contact ariba.secops@sap.com with the relevant information immediately.
We may be contractually bound to report incidents to appropriate parties and timing is critical.
Protecting customer data – how can you help?

Securing your digital transformation
Cyberdefense
Multilayers of defense
Holistic: Prevent, detect,
remediate
Comprehensive contracts
Privacy, security framework
applicable local regulations
Independent audits
Service organization report
Certifications
Secure cloud model
Holistic approach
Secure architecture
Build secure, run secure, be secure

Please Complete Session Survey
Locate Session Click Surveys Button Select Breakout Survey Rate Session

Thank you.
Contact information:
Lakshmi Hanspal Gonzalo Bas
Chief Security Officer Business Security Specialist
SAP Ariba Trust Office (SAP) SAP Ariba Trust Office (SAP)
lakshmi.hanspal@sap.com gonzalo.bas@sap.com
@lakshmihanspal

Securing Your Digital Transformation: Cybersecurity and You

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Securing Your Digital Transformation: Cybersecurity and You

Similar to Securing Your Digital Transformation: Cybersecurity and You (20)

More from SAP Ariba

More from SAP Ariba (20)

Recently uploaded

Recently uploaded (20)

Securing Your Digital Transformation: Cybersecurity and You