After his talk there was the opportunity to ask questions. Having the title of his talk in mind and as a member of the SAP Product Security team, I asked a good one (according to Bruce): Assume that you have three wishes what would you like to have from vendors? After a taking a moment to gather his thoughts, he answered that he has actually two wishes, namely honesty and usability. Honesty means that vendors should clearly specify what a given product can do and what it cant do. Usability means that we already have many products with many security functions, but it is still very difficult to use them easily.
Note that SAP is not a vendor of security products, but a vendor that ships products with security functions. Some of these security functions are implemented by SAP, many others are provided by solutions from our security partner ecosystem. However, as a trusted advisor for our customers, we should do our best to fulfill Bruces wishes.
Beginning with honesty, lets explore some examples. The SAP Security Guides, for instance, provide a central overview of security-related functions and settings of individual applications, components, and scenarios for customers, consultants, support, and salespeople . The guide gives recommendations for a baseline level of protection and gives pointers for customers that are aiming for a higher level of protection. Another example is the envisaged Security Bulletin service. Currently, SAP publishes information about security fixes in the SAP Notes that are available to our customers, however, customers that want to focus on security-related notes might find it difficult to find them in a meaningful way. Thus, SAP will offer a dedicated service (analogous to a CERT advisory service ) that briefly summarizes the security issues, provides a risk estimation and a reference to the SAP note that describes the fix. That way, customers will be in a better position to make informed decisions in their own (security) risk management process.
Now lets have a look at usability. Being honest, I have to admit that is not an easy game to understand and implement security in a secure SAP scenario today. However, the NetWeaver mantra simple, robust, model-driven reflects that SAP is following the right strategy. With NetWeaver SAP has aligned several components into one product. As a result, customers can expect more integrated and centralized security functions a significant step toward improving the user experience. Regarding robustness, SAP is taking the initiative to protect the new Web applications running on the SAP NetWeaver platform, as well as the platform components themselves . Besides this, there are internal quality standards in place in order to ensure that baseline security is in place. Both approaches contribute to the usability of SAP security functions as design and implementation weaknesses are addressed and their solutions incorporated centrally. And lastly, model-driven means that SAP listens to its customers. In which scenarios is SAP software used? What requirements have to be met? That way we develop and align security features that are useful for our customers.
I won the prize for the best question (a signed copy of Beyond Fear). By the end of the day Im also very happy that SAP is on the right path toward solving the equation security = honesty + usability.
2. Bruce Schneier, Beyond Fear, Copernicus Books, 2003
3. Bruce Schneier, Weblog Schneier on Security
4. Bruce Schneier, Crypto-Gram
5. SAP Security Guides, http://help.sap.com => Documentation => SAP NetWeaver 04 (english version) => SAP NetWeaver Security Guide
7. Jürgen Schneider, How SAP Protects Your Web Applications from Security Vulnerabilities, SAP Insider, October – December issue, 2004.