{"id":18761,"date":"2020-01-17T00:20:14","date_gmt":"2020-01-16T18:50:14","guid":{"rendered":"https:\/\/www.technologyforyou.org\/?p=18761"},"modified":"2020-01-17T00:09:45","modified_gmt":"2020-01-16T18:39:45","slug":"csa-releases-first-in-a-series-of-critical-controls-implementation-for-sap-guidelines","status":"publish","type":"post","link":"https:\/\/www.technologyforyou.org\/csa-releases-first-in-a-series-of-critical-controls-implementation-for-sap-guidelines\/","title":{"rendered":"CSA Releases First in a Series of Critical Controls Implementation for SAP Guidelines"},"content":{"rendered":"<h3><span style=\"font-family: 'trebuchet ms', geneva, sans-serif; color: #003300;\">Document to help organizations securely migrate to operate ERP applications in the cloud<\/span><\/h3>\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">The Cloud Security Alliance\u00a0(CSA), the world\u2019s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced the release of\u00a0<a href=\"https:\/\/cloudsecurityalliance.org\/artifacts\/critical-controls-implementation-for-sap\">Critical Controls Implementation for Systems Applications and Product (SAP) (Part 1)<\/a>, the first in a series of implementation documents focusing on specific ERP technologies. This document, authored by CSA\u2019s\u00a0Enterprise Resource Planning (ERP) Working Group, takes a more technical, granular approach and is designed to help organizations securely migrate to and operate ERP applications in the cloud.<\/span><\/p>\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">This document and its companion piece, scheduled for release in Q1 2020, act as follow-ups to the\u00a0<a href=\"https:\/\/cloudsecurityalliance.org\/artifacts\/top-20-critical-controls-for-cloud-erp-customers\/\">Top 20 Critical Controls for Cloud Enterprise Resource Planning (ERP) Customers<\/a>\u00a0(June 2019), which took a more general approach to the 20 critical controls required to secure cloud ERP applications. Now, with Critical Controls Implementation for SAP (Part 1), SAP administrators have a more detailed examination of controls implementation, as well as a set of checklists for the for the first set of 10 controls:<\/span><\/p>\n<ul>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">APP01 &#8211; Secure Landscape<\/span><\/li>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">APP02 &#8211; Baseline Secure Configurations<\/span><\/li>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">APP03 &#8211; Security Vulnerabilities<\/span><\/li>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">INT01 \u2013 Secure Integrations and API<\/span><\/li>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">DAT01 \u2013 Continuous Monitoring<\/span><\/li>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">DAT02 \u2013 Data Separation<\/span><\/li>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">DAT03 \u2013 Data Encryption<\/span><\/li>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">BUS01 &#8211; Inventory of Business Assets, Data and Processes<\/span><\/li>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">BUS02 &#8211; Business Process Controls<\/span><\/li>\n<li><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">BUS03 &#8211; Continuous Compliance<\/span><\/li>\n<\/ul>\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif; color: #800000;\">\u201cWithout a framework that aligns with standard controls, security configurations and vulnerabilities for cloud ERP applications can be difficult to navigate. Because ERP applications are so complex and diverse, for any guidance document to be truly useful from an implementation perspective, specific technologies must be addressed. It\u2019s our hope that this set of guidelines serves as a springboard for SAP administrators in their journey to implementing and securing their ERP solutions,\u201d <strong>said Juan Perez-Etchegoyen, chair of the Enterprise Resource Planning working group, and CTO of Onapsis.<\/strong><\/span><\/p>\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">The controls implementation and the checklists apply to SAP NetWeaver(C) ABAP(C) and all its versions and provide a detailed description of the control implementation. The checklists provide general steps as well as some direction on how to carry out the implementation of the controls. Combined with the previously released Top 20 Critical Controls document, it explains who would be typically responsible in an IaaS or SaaS scenario.<\/span><\/p>\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">The Enterprise Resource Planning WG seeks to develop best practices to enable organizations that run their business on large ERP implementations, such as SAP or Oracle applications, to securely migrate to and operate in cloud environments. Individuals interested in becoming involved in future ERP Working Group research and initiatives are invited to visit the\u00a0<a href=\"https:\/\/cloudsecurityalliance.org\/research\/working-groups\/enterprise-resource-planning\/\">join page<\/a>.<\/span><\/p>\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">Download the\u00a0<a href=\"https:\/\/cloudsecurityalliance.org\/artifacts\/critical-controls-implementation-for-sap\">Critical Controls Implementation for SAP (Part 1)<\/a>.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Document to help organizations securely migrate to operate ERP applications in the cloud The Cloud Security Alliance\u00a0(CSA), the world\u2019s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced the release of\u00a0Critical Controls Implementation for Systems Applications and Product (SAP) (Part 1), the first [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":18762,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[11158,11157],"class_list":{"0":"post-18761","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security","8":"tag-critical-controls-implementation-for-sap","9":"tag-top-20-critical-controls-for-cloud-enterprise-resource-planning-erp-customers"},"_links":{"self":[{"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/posts\/18761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/comments?post=18761"}],"version-history":[{"count":0,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/posts\/18761\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/media\/18762"}],"wp:attachment":[{"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/media?parent=18761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/categories?post=18761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/tags?post=18761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}