The number one factor impacting decisions around security for SAP systems is the need to protect access to the sensitive and confidential data in those systems. Attacks are becoming more common, particularly for organizations located in APJ,  and some of the challenges that were identified by respondents to recent SAPinsider research were detecting those threats and keeping up with patches and updates. But organizations also have requirements that their cybersecurity tools provide consistent protection across cloud and on-premise environments, while almost as many want tools that integrate with both SAP and non-SAP systems. What can organizations do to address these requirements?

The Cybersecurity Tools Challenge

To gain insight about cybersecurity tools, SAPinsider sat down with Chris Holland, Vice President of Encryption Software at Thales. One of the benefits that Thales offers in their cybersecurity tools is that they are not just an SAP solution. They provide the ability to address encryption and key management challenges across multiple platforms and clouds. This provides them with an understanding of the pain points that exist for organizations as they look to protect not only their SAP systems, but other environments that their enterprise is using as well. One of the biggest challenges that Holland sees customers face is that, when they’re trying to solve security problems across multiple platforms, they need to use different management tools for each one. This adds complexity to having a consistent approach to security across the organization. “It complicates policies. It complicates backing up keys. It complicates the management of those systems,” says Holland. Having a security solution for different platforms in a single place helps to simplify the management and control of encryption and security for these systems. “Organizations face a challenging landscape for compliance,” Holland continued. “They have internal policies around which users should have access to which data, industry compliance which may come in the form of an industry mandate, and then regional and governmental rules. And these apply across a sprawl of data which is in different places both on-premise and in the cloud.” Bringing all these pieces together is a primary value proposition. Data encryption is a fairly well proven security technology, data encryption was one of the three most used technologies by respondents in our research, but with organizations changing landscapes and moving into the cloud Holland says that the security environment is becoming more complex. This is especially true as data sets are now stored in different locations, and the space that organizations need to secure is much bigger. This is where a comprehensive set of cybersecurity tools can offer simplification as organizations try and address the cybersecurity tool challenge.

Today’s Security and Data Challenges

“There are four main challenges that I see companies trying to address today,” says Holland. “The first is around who has access to what data. The second is around legal and global compliances. The third is around migration to the cloud where organizations need to solve problems both in the cloud and on-premise. And the last is the continued sprawl of data, not just between the cloud and on-premise, but among the different cloud solutions that are out there.” Managing access to data is more than just being about access or process control. An example is that a team that is maintaining, monitoring, and managing a platform may have no need to see the content of that data, but a finance team that is using the system does need access. Giving admins the ability to access the system and verify that files are all working, as well as performing regular backups, without having the ability to read the data in those files can be a complex challenge for many organizations to solve. Solutions like that Thales offers can help solve internal compliance mandates like this. Another example from the challenges that Holland identified is around ensuring that data remains secure and encrypted in any circumstance. Even in a scenario where a breach has occurred, if it is possible to demonstrate that any data that did leave the organization did so in an encrypted form, this can help limit overall exposure. Something that is significantly harder to maintain with the last point that Holland mentioned—that of data sprawl. For organizations that are deploying cloud-based solutions, not only is data being moved into those cloud solutions, but it is also being utilized in other applications provided by the cloud vendors. And with tools being provided by the different cloud providers to easily spin up data stores and cloud-based databases, data is spreading out across the cloud at an accelerating rate. Organizations must be able to support this data explosion with their security solutions. One way that Thales helps organizations address some of these challenges is with a discovery component which helps customers discover where data has reached and understand what kind of information is out there. It’s possible to have an ideal security solution in place, but if you aren’t aware of every place that you must be protecting data it won’t be covered. A tool that helps discover where data is and identify what is sensitive can help address the challenge that data sprawl represents.

Data Security Challenges of the Future

Holland sees the move to the cloud as the biggest factor impacting organizations when it comes to security today. It was important when people started moving workloads to the cloud and is more important now than ever. And that move to the cloud continues to accelerate with more and more data being moved there. Protecting this data and securing it wherever it moves will be a key challenge for the future, just as it is already a challenge for today. Another challenge that Holland sees organizations needing to face is that of the how they manage and secure data that is being increasingly accessed by more demanding and more technically adept users. For most organizations it is no longer sufficient to simply have content delivered electronically. Changing customer expectations mean that many of these organizations are developing their own services, utilizing tools made available through cloud providers. But these also potentially expose increasingly large volumes of customer data and information. Connected to this challenge of an increasing number of services is that, while security used to be something that could be added to solve a specific problem, there is now an expectation that security will be built into to everything that is developed and released. This means that developers will have an increasingly important voice for organizations as they decide how to implement encryption, security, and key management around data. Organizations must ensure that they include this perspective in their future cybersecurity plans.

What Does This Mean for SAPinsiders?

For any organization there is no longer a choice about whether they should invest in security technologies. Securing systems and solutions is critically important for any organization for both SAP and non-SAP solutions and is top of mind at all levels of the organization. But since all organizations are investing in technology solutions, what are the steps that can be taken to ensure that these investments provide the most value?

• Focus on solutions that can provide a comprehensive set of security technologies. Organizations know they need to invest in security technologies. But what should the focus of their decisions be? Holland says that organizations should “focus on the complexity and breadth of places that they need to solve problems. The ability to support endpoints, different database types, file types, cloud environments, key management, and tokenization.” Solutions that can address all these needs, such as those that Thales offers, offer the benefit of bringing everything together in one place.
• Create and implement a plan for how you will secure your data as it moves through your organization and across the cloud. One of the biggest security challenges for organizations in the future will be ensuring that their data continues to be protected as it moves across the enterprise and to and between cloud-based applications. Not only will it be important to ensure that security is implemented on existing applications, but it must also be built-in to applications and connections. Take the time to understand where your data is located and how it is being secured today, leveraging discovery tools like that provided by Thales, to ensure that you have a plan to encrypt and secure data both now and in the future.
• Ensure that your future application development includes security at the outset, not something that is added later. As your organization develops applications to support your customers, whether B2B or B2C, any new application development must include data security from the outset. Government regulations increasingly stipulate details around data security, more and more data is potentially connected to and exposed via applications, and with attacks becoming more prevalent, it is vital to organizations that security, and data security in particular, be included from the start of the process. It is only by doing this that organizations can prevent breaches.

 

About Thales

Businesses and governments rely on Thales to bring trust to the billions of digital interactions that they have with people. More than 30,000 organizations already rely on Thales solutions to verify the identities of people and things, grant access to digital services, analyze vast quantities of information, and encrypt data. Every organization around the world is in the midst of a transformation and stands to benefit from Thales’ innovations. As the world becomes more connected, Thales makes it more secure.