Secure By Default returns with SAP S/4HANA 2022

The feedback on secure by default in SAP S/4HANA shows that our approach is highly appreciated by customers. With the release of SAP S/4HANA 2022, our “Secure by Default” program continued and we addressed additional topics in fresh installations or configurations. This time we also approached adjacent components like SAP Host Agent and SAP Start Service to realize TLS1.2-only settings for SAP S/4HANA.

With SAP S/4HANA 2022, we extended the scope and coverage again, addressing several important configurations. Latest secure by default settings are applied for

• SAP S/4HANA 2022
• All SAP products based on S/4HANA Foundation 2022

List of new Secure By Default Settings

In new installations, system copies and conversions the following security relevant settings and configurations are applied automatically:

• Prevent usage of non-reference user as reference user to protect against a common attack vector to hide SAP_ALL assignment
• Enforce TLS1.2-only for web-based interfaces of SAP S/4HANA to reflect deprecation of TLS1.0 and TLS1.1 by the industry. This covers
  • SAP Internet Communication Manager (ICM)
  • SAP Start Service
  • SAP Host Agent
• Mandatory SSL protection for session logon tickets to protect against session hijacking
• Protect the RFC gateway against unauthorized RFC call forwarding to prevent bypass of firewall rules
• Performance optimized log of RFC and SICF usage to support deactivation of unused RFC function modules and SICF services for attack surface reduction

Additional Information

As with SAP S/4HANA 1909, SAP S/4HANA 2020, SAP S/4HANA 2021, customers will receive the security settings automatically with new installations, system copies and conversions. An opt-out is possible for the security relevant profile parameters, but not recommended from SAP side. More details can be found in the SAP Note 2926224.

As secure by default settings cannot and will not cover all aspects of security settings in S/4HANA systems, we highly recommend customers to perform additional reviews and improvements of their security settings. Good sources are the SAP security whitepapers. Secure by default settings provide a good starting point, but there are additional security settings and configurations which are either customer specific, cannot be shipped as default or need to be applied on a regular basis (e.g. security patching).

• Use the SAP-provided tools and services, such as Early Watch Alert, Configuration Validation and System Recommendations in order to display missing security patches. These inform you about gaps in a cost efficient way.
• Always introduce disruptive security settings with good timing. Conversion projects and new installations are very good points in time to increase security. As a benefit, no additional effort for security testing is required, as testing is scheduled anyway. And this is the most expensive part of security.

Please refer to these blogs for older SAP S/4HANA releases

• For SAP S/4HANA 2021 – Secure By Default, please also refer to this blog The story resumes – Secure By Default for SAP S/4HANA 2021
• For SAP S/4HANA 2020 – Secure By Default, please also refer to this blog Secure By Default for SAP S/4HANA 2020
• For SAP S/4HANA 1909 – Secure By Default, please also refer to this blog Secure By Default: Ways To Harden Your Systems At (Almost) No Cost

Complete List of all SAP S/4HANA Secure By Default Settings

Below you can find a complete list of all secure by default settings that are included in SAP S/4HANA 2022. Bold entries were added with SAP S/4HANA 2022:

• Security relevant profile parameters are set to secure values which increases security in areas such as:
  • Mandatory SSL Protection of session logon tickets (part of S/4HANA 2022)
  • Protect the RFC gateway against unauthorized RFC call forwarding (part of S/4HANA 2022)
  • Strong password policies and password hashes (part of S/4HANA 2020)
  • Protection of internal system communication (part of S/4HANA 2020)
  • Strengthened authorizations system (part of S/4HANA 1909)
  • Enhanced RFC interface protection (part of S/4HANA 1909)
  • Enforce TLS1.2-only for web-based interfaces of SAP S/4HANA covering SAP Internet Communication Manager (ICM), SAP Start Service, SAP Host Agent (part of S/4HANA 2022)
• Security relevant configurations and customizing are set to secure values
  • Prevent usage of non-reference user as reference user (part of S/4HANA 2022)
  • 3 parameters were changed to secure defaults in the Transport Management (part of S/4HANA 2021)
  • Web protection is increased by activation of the UCON HTTP allowlist (part of S/4HANA 2021)
  • Start authorizations for WebDynpro were enabled for an improved security for Webdynpro applications (part of S/4HANA 2021)
  • All available scenarios of the Switchable Authorization Framework (SACF) are activated which adds additional functional authorization checks for technical function modules (part of S/4HANA 2020)
  • All available scenarios of the Generic Application Access Rules (SLDW) were activated as defined by SAP development (part of S/4HANA 2021)
• Security relevant logging was enabled to support traceability and security monitoring
  • Performance optimized log of RFC and SICF usage to support deactivation of unused RFC function modules and SICF services (part of S/4HANA 2022)
  • SAP HANA Audit Log is switched on for HANAs running SAP S/4HANA. This enables traceability of activities on SAP HANA database level (part of S/4HANA 2021)
  • Security Audit Log is activated what allows customers to trace critical activities in the system (part of S/4HANA 1909)
  • Activation of table logging for business-critical tables (part of S/4HANA 2021)
  • HTTP server and HTTP client log of the SAP Internet Communication Manager is enabled (part of S/4HANA 1909)
• Values of additional security relevant profile parameters were changed in the kernel default