Fundamentally at the center of illegal operations that businesses need to worry about, is that most people don’t think like criminals and are then unprepared for how vulnerabilities in their systems can be exploited. For instance, most of us couldn’t have imagined how the pandemic would impact criminal operations.  But there are criminals that need open borders to conduct their illegal trade.  With closed borders and stay at home orders, the disreputable turned to cyber to fill their coffers.

And there are so many things to consider. Your employees are working more from home, possibly in a less secure environment with their own, private hardware connecting via non-company networks that require an access process.  You are accelerating the transition of portions of your business to the cloud to handle the changing business environment and worry where the weak points may be.  You may have a piece of custom code that has unwittingly left a door open to a hacker. Everything has gotten more complex.  Where do you start?

Where Do I Begin?

The process becomes more manageable if you break it down establishing a systematic approach.  The chart below diagrams the 5 categories to review and the areas that should be considered.  This is a joint, collaborative process between you and SAP, and involves more than system or landscape hardening as process failure points are just as vulnerable.

When looking at these 5 layers for review, the Environment at the bottom and the Organization layer at the top are areas where each business would take the lead and SAP can advise on SAP-specific items.  But the focus for your SAP MaxAttention and SAP ActiveAttention team will be on the center 3 blocks of System, Application, and Process.

A Security and Compliance Workshop starts the review identifying gaps and weak points, and through this discussion awareness of less obvious security issues can come to light.  Trying to address 100% of these findings is not the goal as this would be expensive and time consuming.  But prioritizing the recommendations, especially identifying and closing the most common ‘open doors,’ yields an effective approach that can lead to long lasting success.  This is the first step in the 3 steps process currently available remotely with your SAP MaxAttention and SAP ActiveAttention contract (also available as an SAP Value Assurance offering):

1. Focus on HARDENING of your security settings ‘Close known open doors’
2. Focus on PREVENTION of cyber-attacks ‘Protect and ensure’
3. Focus on DETECTION of cyber-attacks ‘Monitor and respond’

There are also things that you can start with right away:  utilize the SAP EarlyWatch Alert  available to you as a collaboration platform with SAP!(1) It provides you with a quick overview of critical situations in your landscape. Keeping your software up to date is also key and should be done on annual basis at minimum. In the interim, fix urgent issues leveraging the SAP Security Notes.

When Should I Start?

Ideally, you should start planning your security approach as early in your project as possible.  If you are in the early stages of transitioning to the cloud or a hyperscaler for instance, preparing now will avoid a lot of work in the future.

McKinsey had noted that while some industries didn’t see an effect at the beginning of the pandemic, most anticipate that this will change in the coming months.  Many security professionals are asking for budget increases in 2021 in preparation for mounting security concerns in the changing business environment.

Security does not remain static of course. You don’t make recommended changes and then decide that it is all done.  Hackers are always looking for opportunities, landscapes and technologies change, and new attack patterns arise.  Thus, the review process should be repeated annually to ensure that things do not become lax as time goes on.

Future Outlook

There are many indicators that companies will offer more remote work opportunities going forward to attract talent and there is plenty of chatter regarding reducing office space and thus capital expenditure.  Consumers may turn their current buying approaches into habit and prefer online shopping to brick and mortar browsing. Seeing these short-term adaptations as trends equips us to be ahead of the curve. Adopting a solid cybersecurity process now allows you to concentrate on your core business making cybersecurity proactive more than reactive.

The most successful businesses look on challenges as opportunities.  Adapting to the current crisis sets up an environment for businesses to thrive into the future.

________________________________________________________________________________

(1) Authorization is required. Please see https://blogs.sap.com/2019/10/01/displaying-security-alerts-in-the-sap-earlywatch-alert-workspace/

Author: Fritz Bauspiess