{"id":40947,"date":"2021-05-19T18:00:28","date_gmt":"2021-05-19T18:00:28","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=93550"},"modified":"2021-05-19T18:00:28","modified_gmt":"2021-05-19T18:00:28","slug":"protecting-sap-applications-with-the-new-azure-sentinel-sap-threat-monitoring-solution","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/protecting-sap-applications-with-the-new-azure-sentinel-sap-threat-monitoring-solution\/","title":{"rendered":"Protecting SAP applications with the new Azure Sentinel SAP threat monitoring solution"},"content":{"rendered":"

As one of the leading solution providers for applications that manage business processes, SAP is the custodian for massive amounts of sensitive data in many of the biggest organizations in the world.<\/p>\n

Since these applications are business-critical, an SAP security breach can be catastrophic. Yet, protecting SAP applications is uniquely challenging. These systems are growing in complexity as organizations expand them beyond base capabilities. They are vulnerable not only to outside attacks, but also insider threats. What\u2019s more, their complex nature means that threats can emerge across multiple modules, making cross-correlation especially important.<\/p>\n

It has been traditionally very difficult for security operations (SecOps) teams to effectively monitor them due to the unique nature of the SAP ecosystems and the expertise they require. We set out to meet this challenge with the new SAP threat monitoring solution<\/a> for Azure Sentinel<\/a>. Now in public preview, the solution provides continuous threat detection and analytics for SAP systems deployed on Azure, in other clouds, or on-premises. Now, SecOps teams can use Azure Sentinel\u2019s visibility, threat detection, and investigation tools to protect their SAP systems and cross-correlate across their entire organization.<\/p>\n

Effective SAP threat monitoring<\/h2>\n

An effective approach to SAP threat monitoring has several key requirements:<\/p>\n

    \n
  1. Multi-layered coverage: An SAP threat monitoring solution needs to cover both the infrastructure layer (virtual machine, storage, and network) as well as the business and applicative layers since threats traverse every layer of the SAP system.<\/li>\n
  2. Rich insight into SAP applicative and transactional data: SAP systems produce viable security data in the form of change documents, audit logging, job execution, data transformation (table data), and more. For a complete picture of potential threats, you need visibility into all this activity.<\/li>\n
  3. Correlation across enterprise data sources: SAP systems are complex, and indicators of compromise often aren\u2019t straightforward. To reduce noise, it\u2019s imperative to cross-correlate across additional data sources such as network, storage, or identity data, as well as across other entities, such as systems and users.<\/li>\n
  4. Flexible deployment: SAP NetWeaver systems can be deployed on-premises, in the cloud, or hybrid deployments. Any effective SAP monitoring solution needs to offer deployment flexibility and provide visibility into any of these deployment configurations\u2014especially since cloud transformation is often a long, multi-stage process, and organizations may find their SAP deployment method changing over time.<\/li>\n
  5. Threat detections specific to SAP: SAP systems are unique environments facing unique threats. An effective monitoring approach needs to include threat detections and analytics tailored to SAP-specific use cases and threats.<\/li>\n
  6. Customizability: On the flip side, SAP ABAP platforms inclusive of S\/4HANA are also highly custom in nature, which means that you can\u2019t rely solely on out-of-the-box detections. The SAP threat monitoring approach needs to be open to modification and include the ability to build or import your own security content, so you can tailor detection to your specific environment.<\/li>\n<\/ol>\n

    Our approach: The SAP threat monitoring solution for Azure Sentinel<\/h2>\n

    We kept these requirements top of mind when developing our approach to SAP threat monitoring. The Azure Sentinel SAP threat monitoring solution can be deployed in one simple package that includes all components. The solution includes:<\/p>\n