The Cloud
Security Alliance (CSA), the world’s leading organization dedicated
to defining and raising awareness of best practices to help ensure a
secure cloud computing environment, today announced the release of Critical
Controls Implementation for Systems Applications and Product (SAP) (Part
1), the first in a series of implementation documents focusing on
specific ERP technologies. This document, authored by CSA’s Enterprise
Resource Planning (ERP) Working Group, takes a more technical,
granular approach and is designed to help organizations securely migrate
to and operate ERP applications in the cloud.
This document and its companion piece, scheduled for release in Q1 2020,
act as follow-ups to the Top
20 Critical Controls for Cloud Enterprise Resource Planning (ERP)
Customers (June 2019), which took a more general approach to the 20
critical controls required to secure cloud ERP applications. Now, with
Critical Controls Implementation for SAP (Part 1), SAP administrators
have a more detailed examination of controls implementation, as well as
a set of checklists for the first set of 10 controls:
- APP01 – Secure Landscape
- APP02 – Baseline Secure Configurations
- APP03 – Security Vulnerabilities
- INT01 – Secure Integrations and API
- DAT01 – Continuous Monitoring
- DAT02 – Data Separation
- DAT03 – Data Encryption
- BUS01 – Inventory of Business Assets, Data and Processes
- BUS02 – Business Process Controls
- BUS03 – Continuous Compliance
“Without a framework that aligns with standard controls, security
configurations and vulnerabilities for cloud ERP applications can be
difficult to navigate. Because ERP applications are so complex and
diverse, for any guidance document to be truly useful from an
implementation perspective, specific technologies must be addressed.
It’s our hope that this set of guidelines serves as a springboard for
SAP administrators in their journey to implementing and securing their
ERP solutions,” said Juan Perez-Etchegoyen, chair of the Enterprise
Resource Planning working group, and CTO of Onapsis.
The controls implementation and the checklists apply to SAP NetWeaver(C)
ABAP(C) and all its versions and provide a detailed description of the
control implementation. The checklists provide general steps as well as
some direction on how to carry out the implementation of the controls.
Combined with the previously released Top 20 Critical Controls document,
it explains who would be typically responsible in an IaaS or SaaS
scenario.
The Enterprise Resource Planning WG seeks to develop best practices to
enable organizations that run their business on large ERP
implementations, such as SAP or Oracle applications, to securely migrate
to and operate in cloud environments. Individuals interested in becoming
involved in future ERP Working Group research and initiatives are
invited to visit the join
page.
Download the Critical
Controls Implementation for SAP (Part 1).
About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization
dedicated to defining and raising awareness of best practices to help
ensure a secure cloud computing environment. CSA harnesses the subject
matter expertise of industry practitioners, associations, governments,
and its corporate and individual members to offer cloud
security-specific research, education, certification, events and
products. CSA’s activities, knowledge and extensive network benefit the
entire community impacted by cloud — from providers and customers, to
governments, entrepreneurs and the assurance industry — and
provide a forum through which diverse parties can work together to
create and maintain a trusted cloud ecosystem. For further information,
visit us at www.cloudsecurityalliance.org,
and follow us on Twitter @cloudsa.
View source version on businesswire.com: https://www.businesswire.com/news/home/20200106005660/en/