Transcript
is provide kind of recommendations to the audience. So, you know, and the key word there on the slide is that continual validation of security. So, for those of you who work in security, you know, it's really a never-ending task. If you're dealing with kind of on-premise technology, then every month there's new notes or patches, et cetera, depending on the technology that you need to address. So, you have to constantly kind of maintain and keep up with security. So, I wanted to kind of put kind of some key elements that I thought were important to do. First off the bat is that regular security audit. So, you know, you can spend that time and effort, as JP said, to go through, I think it was 225 pages of kind of different recommendations to get what's right for your enterprise. Every enterprise kind of has their kind of level of security posture that they're ready for. But these are configurations that can be changed by anyone. So, you need to make sure that you're continually ensuring that you stay at that level. This recommendations change over time as well. As new technology is added into BTP, then there's security associated with those. So, it's not a one-and-done type of exercise. You need to make sure that you're keeping up with what's going on from a security point of view. And then you can see it's kind of what are my users doing? Are they doing what they should be doing? Maybe a month ago they should have been doing that. Is that something they should still be doing now? JP touched on using identity providers, kind of make sure that you're using the authentication technologies that's right for your business. Don't make your users learn another login, but try and leverage what they already have. And then kind of training for teams. So, people who are working in BTP, developing for BTP, can ensure that they have what they need to do so in a secure way. And then really across the enterprise, that can be kind of an additional firewall as your users having a security training, having an ability to react and report on things they see that don't meet kind of security thresholds. So, identifying, phishing for you, etc. And then lastly, exactly what you're doing right now. Security is a journey for all of us. We learn from each other. So, taking advantage of the SAP security community, that there's a lot of kind of content like this and other content available where we're trying to ensure that we all have visibility and understand kind of what does security mean now. Things are changing and changing even faster really with the advent of BTP and other technologies. So, how can I keep up and ensure that I'm informed about what are kind of the latest risks and the latest kind of guidance for security to SAP technology. I would be remiss if I didn't come in and talk a little bit about how we could help. I promise I'll just do 60 seconds. But, you know, one of the reasons that JP and I kind of able to talk about this is because we work with our customers to help them ensure all of their investments in SAP can be, you know, managed and run in a secure way. So, you can kind of see across the top that we work with SAP, whether it's on premise, it's hybrid. So, a little bit of both in the cloud. BTP is obviously we've been focused on here or going with RISE. And we do it through kind of three core pillars. We have assess, which is vulnerability management. So, vulnerabilities could be considered SAP notes, but it also could be what we've been talking about, insecure configurations, users with really high permissions or authorizations on a target system, helping you identify kind of where they are, what the consequence of allowing those to exist could be, and giving guidance on how to address those. With defend, kind of talking about what's going on on those systems. So, from a threat point of view, is someone attempting to exploit vulnerabilities on that system? Is someone performing an action, which is very kind of a highly sensitive action? And, you know, is that something that should be performing? And when we look at kind of BTP, there's a lot of actions that can be performed there, cloning, et cetera, copying, which really could expose a lot of risk. And then if we have a look on the right hand side, it's all about kind of DevSecOps for SAP. So, as you're customizing and adding that extra value on top of these technologies that BTP provides, are you doing so in a way that doesn't expose you to more risk? We do this all through our premium certified kind of SAP endorsed apps. So, SAP has singled us out as an application and provider that they endorse, that they encourage people to use because it helps ensure all of us are running more secure SAP systems. So, I'm going to stop talking because I've been talking a lot. I'm going to bring this slide up, but the slides will be shared. JP, any final words you'd like to give before we go to hand it back to Sean for the questions? No, just, again, we are talking about business applications and as such, there is a lot of value on the data and the processes. Federal actors know about it and they've been addressing more and more and targeting more and more of these applications, either by targeting the technology, by using malware, by stealing credentials. There are many different ways that actors have to ultimately compromise these applications and data. So, it's important to have security, not as an afterthought, but really as a driving force. It's especially important for those of you who are beginning their first steps of the implementation of BTP because a lot of the definitions are going to drive security requirements. Otherwise, it becomes technical debt and it becomes harder and more expensive to secure, to implement.
