SAP HANA Database security

[#1]

Hello everyone,

I often hear that the data stored in an SAP HANA database are "certified", technician says that SAP "certified" your data.
Are these claims true? Or in which way are true?
Is it certified that nobody change the data in the db? 

If yes, how?

I know that no changes can be made at the application level, for example change an invoice.
My question, however, is at the database level.

An expert technician, that know all the table involved in a registration, could write an update procedure that change some data?

Thank you very much
Paolo

[D_Olderdissen]

Hi Gino,

I think you are describing a product unrelated security challenge - how to secure the security. 😄

In my mind, the top level of roles (those user rights that can freakingly do anything they want) get special protection. I guess there are various concepts available - a security process expert will be able to tell you more. e.g. segregation of duties, 4.- eyes principle etc.

Segregation of duties - the top user rights assigning roles would ONLY be handled by a security team. I heard some customers that implemented a 4-eye principle by having the password of a technical user split in two - part 1 of the PW only knows one admin, part 2 of the PW only the other admin. Again, security process people should know all the tricks.

Cheers,
Dirk

[former_member612251]

Quite right Dirk 🙂

[former_member612251]

Hi Gino,

What exactly is the question here? No functional people should have access to the HANA DB, usually only your basis people and some BW Developers would need access. HANA follows the same security principls as every other DB, least privilege. You'll always run a risk of a breach if the security isnt managed correctly

[Former Member]

Hi MIchael,

thanks for your quick reply,

I think you answer to my question, just to better explain I try to summarize in two sentences:

Using SAP in his company, a General manager could be sure that employes can't change data without "leave traces", for example they can not change the total of an invoice alredy recorded.

But, the same General manager could not be sure that developers allow to work on db could change something.

Thanks again

G

[former_member612251]

Hi Gino,

With enough access,regardless of the DB, application etc, a potential malicious attempt can do damage. Developers shouldn't be given access to schemas if its not relevant for their work, only particular roles should be given also, this is all relevant to the principal of least privilege. All changes are recorded on audit trails, which can be checked at any time. The HANA DB Admins would have security protocols in place to monitor sensitive users, users with roles such as DATA ADMIN, _SYS_BI_CP_ALL, etc.

What you are asking here is relevant for all security, on every platform, in every company. There are a multitude of answers and recommendations of how best to be securely compliant.