Shortfacts - October 2016

Hana requires new security architecture

Careless use of SAP Hana can result in serious security vulnerabilities.

Hana as the technical basis for all new SAP applications, including S/4 and the Hana cloud platform, is also used by third-party providers to develop and offer applications and mobile apps.

This means that the potential attack surface is growing rapidly. The security gaps are not only caused by a lack of patches, but the configuration also already contains some serious sources of error.

In classic NetWeaver-based SAP systems, the application and database levels are clearly separated from each other. By using Hana, the familiar Abap applications are replaced by newly created functions in the Hana database.

This also makes the security concepts and settings used to date obsolete and they need to be replaced. At the same time, the centralization of data and functions in Hana means that the pros and cons are very close together.

If attackers manage to gain access to Hana, all avenues are open to them for spying on, modifying and deleting business-critical data.

IBS Schreiber offers an external audit and consultation on this topic.