Sustainability, as we all know, is a business goal. In reality, an enterprise cannot achieve that goal unless it becomes a technology goal as well. Technology empowers businesses to achieve sustainability goals and will even protect them from modern threats, which can easily derail sustainability goals.
Overview
So, now as we understand, technology is critical for an enterprise’s sustainability goals. This means that
cybersecurity becomes even more critical for our sustainability ambitions. We will talk about five cyber hygiene practices you should do. These practices will help your organization run critical business operations in SAP, protect key functions, and help achieve its sustainability goals.
Five SAP Cyber Hygiene Practices to Protect Your Enterprise’s Sustainability Goals
- Think Cloud First for Your SAP Needs
- Thinking cloud first for your SAP needs not only helps you reduce costs down the line, but it also gives you a more secured and compliant landscape. This is probably the most important move for IT that will contribute to your sustainability goals.
- Moving to the cloud is more cost-effective. It allows you to scale while sharing underlying infrastructure and even utility bills with other enterprises.
- Moving to the cloud also allows your company to benefit from sustainability efforts from public cloud companies, where they use renewable energy and efficient hardware and equipment, which may be more difficult to access on your own.
- Protect Your Keys
- In today’s world, ransomware is in the news every day. No one is spared, no matter what you do or how big of an enterprise you are. To meet cybersecurity needs, you must protect your critical SAP applications, backup servers, and even your encryption keys.
- Remember, a ransomware attack can be the biggest threat to your enterprise. It can easily derail your organization’s efforts toward sustainability.
- The rule of thumb is to back up your critical SAP applications, databases, and servers regularly. Be sure to keep multiple copies in multiple places. More importantly, remember to protect your keys and never keep your encryption keys where your data or backup is.
- You should probably use your own customer-managed keys and rotate them regularly. That way, even if bad actors get access to your data and backups, it is still useless for them, and you can easily recover from any potential ransomware attack.
- Think Beyond Traditional SAP Security
- For all SAP security insiders protecting your organization’s critical SAP applications and infrastructure, now is the time to look beyond traditional SAP Security, which was previously limited to user/roles, access control, GRC, and compliance.
- If you don’t cover all aspect of cyber for your SAP landscape, it will be very hard to protect your business from risks. These can easily disrupt your organization’s business goals such as sustainability.
- In the new technological landscape, nothing is ever internal only or running on a secure system—including SAP. You need to start adding security programs like Vulnerability Management, Threat Monitoring, Logging and Monitoring, and Infrastructure Security for your SAP landscape.
- You can look into SAP’s own tools like ETD (Enterprise Threat Detection) or third-party vendors like Onapsis to do most of these cyber activities. You can also integrate into your SIEM programs like Splunk, etc. This will ensure that your Cyber SOC (Security Operation Center) team has visibility within SAP and your organization is protected against modern threats.
- Patch Your Systems
- Protecting critical SAP systems to assist with sustainability efforts revolves around having a good patch management process.
- The patch management process should include a comprehensive policy and procedures to cover emergency patching and routine/recurring patching. It should also include all layers (Application, Database, Operating System, etc.) of SAP. It should not be limited to the application layer only.
- All SAP Cybersecurity insiders, please make sure that you include SAP Monthly Patch Days (every second Tuesday of the month) into your process and have a tool to confirm a security vulnerability has been remediated via patch. Tools like SAP Enterprise Threat Detection (ETD) and Onapsis, as discussed earlier, can help you there.
- Automation and Reporting Are Key
- If you are not automating processes, you are indeed putting your organization at risk. That can impact its business goals like sustainability.
- Organizations should rely on automation to scan critical SAP systems against known vulnerabilities, use infrastructure as code to manage resources to avoid human errors, and use Intrusion Prevention System (IPS) or Intrusion Detection system (IDS) to protect against threats and known signatures.
- You also need to make sure you have a robust reporting and dashboard mechanism to give your cyber and business leaders full visibility into your SAP Cybersecurity Posture. That way, leaders can focus on gaps and risks and take corrective actions.
Conclusion
To summarize, the five hygiene steps will appear to be basic SAP cybersecurity measures we already should be doing. Our goal was to offer perspective from a tech and business risk/reward perspective. That way, technology can work hand-in-hand with business and help organizations achieve their business goals—including sustainability.
