SAP Business One In The Cloud: Beyond The Cloud Control Center

Internal SAP Employees and Partners OnlySMB Innovation Summit 2019SAP Business One in the Cloud:Beyond the Cloud Control CenterAndre SilveiraMichael Cardi SAP Brazil SAP AmericaSpecial Thanks to:Cornee BoorsmaGustav Szenczi SAP Netherlands SAP Labs Slovakia

Agenda Business One In The Cloud Scope Architecture Partner Value-add SecurityService Continuity Disaster Recovery & High Availability MonitoringPartner PanelWrap-up 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ Confidential: Released for Partners2

SAP Business One in the Cloud

SAP Business One Cloud OfferingThe SAP Business One Cloud offering has two aspects:1. Subscription-based licensing Covers software, service and support Separate SAP Business One Cloud pricelist Migration of existing perpetual licenses is possible2. Cloud Control Center for SAP Business One SAP Business One Cloud solution Cloud Control Center SAP Business One The Cloud Control Center is a web application that enables cloud operators to manage the SAPBusiness One Cloud Landscape. 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ Confidential: Released for Partners4

Mobile appsSAP Business One UserService Unit A (Version X.1)Service Unit B (Version Y.2)CustomerAccess SAP Business One Sales App Service App Data Transfer Workbench SAP Crystal Reports SAP Business One Sales App Service App Data Transfer Workbench SAP Crystal ReportsPartnerManagement Customers Tenants User and Credentials Licenses Extensions Customers Tenants User and Credentials Licenses Extensions SAP HANA Database SAP Business One Services Presentation Server Integration SAP HANA Database SAP Business One Services Presentation Server IntegrationUser PortalReseller OperatorCloud Control CenterLanscapeManagementCloud OperatorShared Landscape Components

Landscape ManagementDedicated to a Single Service UnitSuse iceLayerSAP HANA obileserviceSAP BusinessOne ClientSAP Business One ServicesShared between Multiple Service UnitsIntegrationFramework (B1if)IntegrationCentral ComponentsWLicense ServerBrowserAccessPresentation ServerW SStorageWExtensionsSLD/CloudControl CenterWSSLD AgentWDomainController

How to join forces to build sustainable cloudPartner KnowledgeWhat to expect from B1 Cloud CenterInfrastructuremanagement3rd 1. Customer & Tenant lifecycle managementCCC2. User Management3. Extension management4. Reseller operations5. Seamless integration with essential 3rd party tools 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ Confidential: Released for Partners7

Security

Authorization controlActive Directory - Organization UnitsOrganization UnitsActive Directory structure generated by Cloud Control Center ismonolithic and outdated.UsersB1 CloudCloud OperatorsPreferred structure would include organizational unit to achieve: Resellers Better transparency and clean User Active Directory structure Ability to delegate administrative tasks to dedicated users Ability to deploy custom Group Policy Objects per organizationunits Reseller NameResellerOperators Customers Customer NameCustomer Users 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ Confidential: Released for Partners9

Resource access controlActive Directory - Security GroupsAll users should have access to only those resources, that are needed for the users’ role.Security groups can provide efficient way to access to control and limit the resource access.Cloud OperatorsCloud OperatorsResellersCustomerTenantOperators of all ResellersUsers of all CustomersUsers of all TenantsOperators of specific ResellerUsers of specific CustomersUsers of specific TenantUsers of Reseller Customers 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ Confidential: Released for PartnersService Unit Users10

Network segregationSecurityIntroducing security groups into a landscape has several benefits: Reducing congestion – As there are fewer hosts in the subnetwork, local traffic is minimized Improved security – Broadcasts are minimized, therefore limiting visibility outside the group. Attacksurface is minimized as well, so if one group becomes compromised the other hosts still retain theirsecurity Containing network problems – Limits impact of failures in one network to propagate further into thelandscapeQuick tips: Ensure that only those ports that are needed are opened. If a security group contains only web servers,then probably only ports 80 and 443 are needed If the ports do not need to be accessed by everybody, set the appropriate rules. (E.g. LB and WS) Specify outbound rules of a security group as well. This prevents using your hosts in all kinds of attacksWhen setting up security groups, it is a good practice to place all hosts serving the same purpose into onesecurity group. This means, that all DB servers should be in one security group, all web servers in another,and all application servers in another. 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ INTERNAL11

Restrict Unauthorized Code / control code executionSAP Business One Client and extensions are running directly on operating system.If the end users can run and/or install software, then attackers can do as well.Therefore we need application whitelisting to: Restrict executing all files (and DLLs) except the specified list. Blacklisteverything, whitelist needed files for specific users or user groups Log every attempt to execute restricted executable (or DLL) and regularlyreview logsTypical executables to restrict from executing by an end user in Windows environment should include:regedit.exe, explorer.exe, cmd.exe, tasklist.exe, rundll32.exe, svchost.exe, The same applies to scriptinterpreters including: python, csc, The goal is to limit the attack surface by denying visibility into thesystem as well as removing tools for controlling it. 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ Confidential: Released for Partners12

FirewallThe first (inbound) and last (outbound) line of defense in the cloud environment is a firewall, which preventsunwanted traffic from reaching deeper parts of the landscape.Quick tips: All changes to the firewall rules should be logged into the audit log Use automation to update firewall settings. The automation can serve as a documentation to firewall rulesas well Firewall rules (or the automation rules) should be part of backup & restore procedures Review firewall rules regularly and remove unused, overlapping rules. Similarly, consider if rule isnecessary if it hasn’t been triggered for an extended period of time Regularly audit firewall logs for suspicious activity. Create monitoring and logging rules for those Keep firewall software and firmware up to dateAbout 99% of firewall breaches are caused by firewall misconfiguration. More in-depth firewall configurationchecklist can be found here: llChecklist.pdf 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ INTERNAL13

Limiting Data AccessSecurityWhen hosting a non-native cloud application, often times the only possibility forcontrolling and limiting the application functionality in terms of data access is tohave rules for accessing only the parts of disk (or shared storage) as well asrules for accessing data. It is common for non-cloud applications to be built tobe used by one user only and don’t have built-in strategies for user isolation.Quick tips: Data access should be synchronized with authentication & authorizationsource, so that all changes to it are propagated across the landscape All users should have access to only that data that is needed for the users’role. This is true for standard users, technical users, DevOps, Apply the same principle as in every lock-down. Lock everything, then applypermissions to needed locations and databasesIn Windows environment, the C:\Windows directory and its’ subdirectories need to be accessible, as well aspersonal directory in C:\Users and C:\Program Files (for reading, including it’s x86 vesion). Other disklocations might include C:\Temp for example. 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ INTERNAL14

One Authentication & Authorization SourceSecurityTo be able to control the access to the landscape, it is necessary for authentication and authorization sourceto exist. For maintainability, it is important, that there is one and only one source. This provides confidencethat changes to this source are propagated throughout the landscape and that all services check theauthentication and authorization against this source.Quick tips: The source should be extremely well protected against change. If possible, network segregation shouldbe used to increase its’ protection All changes to the source should be logged into the audit log The content of the source should have a backup & restore strategy set, so that in case of disaster, it canrestore its’ operations quickly The source should be run in high availability. If the service(s) providing the authorization source fail, it willbe impossible to log into the landscapeEach user, that has access to the system (customer, admin, DevOps, technical user) should have minimalprivileges, that allow for performing the task. This is true in every aspect of access, whether it is diskaccess, network access, services access, data access, 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ INTERNAL15

Restricting Unauthorized CodeSecurityEven when limiting data access (to the disk), there are still directories (or executables) that need to beaccessible to end user. The problem with non-cloud applications is, that they are running directly onoperating system. There are a lots of ways, which cannot be prevented by disk access authorization, butwhen executed can cause significant damage to the host or even landscape. This is especially true inWindows operating environment.Quick tips: By default, restrict executing all files (and DLLs) except the specified list. Blacklist everything, whitelistneeded files for specific users or user groups Log every attempt to execute restricted executable (or DLL) Be aware of the fact, that blacklisting all executable files may cause a lockout of the host (nobody will beable to log in, since critical executables are restricted from execution)Typical executables to restrict from executing by an end user in Windows environment should include:regedit.exe, explorer.exe, cmd.exe, tasklist.exe, rundll32.exe, svchost.exe, The same applies to scriptinterpreters including: python, csc, The goal is to limit the attack surface by denying visibility into thesystem as well as removing tools for controlling it. 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ INTERNAL16

Service Continuity

Disaster recoveryData backup and recoverySAP Business One defines backup and recovery procedures for software components. It does not have anambition to provide comprehensive backup solution.High AvailabilitySAP Business One provides high availability for critical software components: System Landscape Directory License ServerIt is to use high availability setup important to remove single point offailure. 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ Confidential: Released for Partners18