Safeguarding Enterprise Personal and Financial Data in SAP HANA with IBM Security Guardium

[TusharTrivedi]

Introduction

In the modern digital world, protecting sensitive business data is more important than ever. SAP HANA Cloud databases, known for their high performance and advanced analytics, serve as essential to many organisations' operations. However, the huge amounts of personal and financial data they handle make them potential targets for cyber-attacks. Implementing advanced security measures is critical for protecting these datasets from any possible breaches.

This blog explains how IBM Security Guardium offers an additional level of safety to SAP HANA Cloud databases. You can ensure that enterprise personal and financial data is secure and meets regulatory standards by leveraging Guardium's complete capabilities. Learn how this powerful combo may improve your data security strategy and safeguard your company's most precious assets.

Importance of Data classification and identification for Data security

Identifying and classifying data is crucial for maintaining data security and ensuring compliance with regulatory standards. It helps in understanding the sensitivity and value of data, enabling organisations to implement appropriate security measures. Proper classification aids in protecting sensitive information from unauthorised access and potential breaches, while also facilitating efficient data management and retrieval.

About this blog

In this blog, IBM Guardium can be utilised to discover sensitive data within an SAP HANA DB. By scanning the database, Guardium identifies and classifies sensitive information, such as personal data, financial records, and intellectual property. Once discovered, this data is added to specific groups of fields or objects for continuous observation. This grouping facilitates targeted monitoring and protection, ensuring that sensitive data is safeguarded against unauthorized access and potential breaches. Guardium's scanning and classification capabilities help maintain data security and compliance with regulatory standards for data protection in SAP HANA environments.

Prerequisites

• SAP BTP Account with access to SAP HANA Cloud Database
• IBM Security Guardium

Architecture

SAP HANA Cloud, a cloud-based version of the SAP HANA database, offers a multi-model platform for storing and processing diverse data. It integrates with SAP S/4HANA, the latest ERP suite, and SAP Business Technology Platform for application development. SAP HANA itself has a comprehensive set of security measures to ensure data safety. Additionally, security is further enhanced through IBM Security Guardium. IBM Security Guardium will scan the SAP HANA Cloud DB for the identification and classification of sensitive data such as personal details, financial details ... etc. This data classification will enable administrator to keep an eye on specific table fields and help them formulate further business strategies such as data masking of data hiding for the database for the security purpose. Hence, this architecture positions SAP HANA Cloud as a secured and strong foundation for building versatile cloud-based enterprise applications.

Steps for integration

Log in to Guardium, and you will be directed to the home page as shown below:

Go to the Discover button on the left-hand panel, open the "Classification" dropdown, and select "Datasource Definitions" as shown below:

Click the "New" button, as highlighted below:

Enter details such application type, name, database type and other details in the pop-up screen as shown below:

Please keep in mind that the username and password for the SAP HANA Cloud database must be entered here.

Disclaimer: SAP does not recommend their customers to use the DBADMIN user for daily tasks. Please note that the DBADMIN user is used only for demonstration purposes. Refer to SAP User Management.

To obtain the host name/IP address and port number, log into your SAP BTP account and click to the space for which you want to integrate Guardium with SAP HANA Cloud DB.

Disclaimer: For enhanced security, SAP recommend their customers to adhere to user connect restriction policies. More details on these policies can be found here: SAP HANA Cloud Database Security Guide - Connect Restrictions. This is an important feature that customers should utilise.

Select "SAP HANA Cloud" as indicated below:

Now, click "Actions" and choose "Copy SQL Endpoint".

Securing public endpoints is a significant concern for customers. It is relevant to note that SAP HANA Cloud will support these endpoints in the near future.

1. Product Vision roadmap entry for all Platform-as-a-Service (PaaS) support across hyperscalers: SAP Roadmap
2. 2023-Q4 support for AWS Private Link (PL) connections to HC HDB SQL Endpoints: SAP Roadmap
3. 2023-Q4 support for AWS PL connections to both HDLRE SQL Endpoints and HDLFS REST Endpoints: SAP Roadmap

Paste the copied SQL endpoint and receive the hostname/IP data as shown below:

And get the port number details displayed follows from the same:

To check the status of your connection, click the "Test Connection" button.

The SAP HANA Cloud database setup is now complete. You can see the details as follows:

Click the Discover button on the left-hand panel, then open the drop-down menu by clicking "Classification" and selecting "Discover Sensitive Data". Refer to the image below.

On the following screen, select "PII [template]". Check out the information as recommended below, then click "Roles" to assign them, and then click the "Next" button.

Select the check box for the template pattern you wish to include (for example, birth date, city) and click the "Copy" button as displayed below and click on “Next” button:

Once we've completed "What to discover," we'll go on to "Where to search" and choose the integrated SAP HANA Cloud database and click on “Next”.

"Run discovery" is a convenience feature that allows you to conduct classification and check the status. Click "Next".

We are now in the "Review report" stage, where we select a list of fields and select "Add to Groupof Object/Field" from the "Add to Group" drop-down and click on the “Next” button.

Select group “SAP Sensitive Data” and click on the “OK” button.

Select group “SAP Sensitive Data” and click on the “OK” button.

Let’s Test

Click the "Setup" button on the left-hand panel and choose "Group Builder" from the "Tools and Views" drop-down list.

Select "Object/Field" from the "Action" drop-down, then select "SAP Sensitive Data" from the list. Click the "Edit" button.

In the pop-up screen, select "Members".

You will be able to see the relevant personal and financial table and fields from SAP HANA Cloud database.

Now that you identified and categorised that sensitive data in your HANA database, IBM Security Guardium can further help to improve data security by adoption of specialised security measures, such as to

- Add encryption or access controls, to safeguard important data from unauthorised access and breaches; or by

- Masking or blocking data access requests that violate regulations or policies

- Configuring alerts for unauthorised access attempts, e.g. if someone from a non-finance department tries to access financial data, an alert can be triggered.

In general, classifying data based on its sensitivity in the first place helps to increase visibility and in turn to comply with regulatory obligations (e.g. by generating detailed reports for audits), prevent data loss, and reduce risks associated with data misuse. These features ensure that data handling procedures are consistent with organisational rules and legal standards, hence improving overall data security.

Conclusion

Securing SAP HANA Cloud databases is critical for safeguarding company personal and financial information from evolving cyber threats. SAP HANA Cloud offers a robust set of security features. More information on these security measures can be found in the SAP HANA Cloud Security Guide.

IBM Security Guardium complements the existing security capabilities of SAP HANA Cloud by providing additional data protection, continuous monitoring, and compliance features. This enhancement can be particularly valuable for customers seeking extra layers of security or specific functionalities that they feel are necessary.

Investing in advanced security measures like IBM Security Guardium not only protects essential data but also demonstrates your company's strong commitment to data privacy and compliance. As cyber threats become more sophisticated, leveraging IBM Security Guardium in conjunction with SAP HANA Cloud's comprehensive security offerings is a proactive step toward strengthening your database's security posture and ensuring the integrity and safety of your company data.

IBM Security Guardium provides enterprise data protection for a variety of databases and data sources, and with the HANA integration, it incorporates it into a corporate-wide data security concept.

More Information

If you have any question or query about SAP Netweaver please refer to SAP Community and for any question or query about IBM Security Guardium refer to IBM Security Guardium Community