Hello and welcome to the SAP HANA Academy.
I’m Denys van Kempen and in this video tutorial series will discuss
SAP HANA 2.0.
The topic of this video tutorial is What's new with security?
A good place to find out what's new in the SAP HANA platform 2.0 is to check the
Release Note.
You can find them online on the SAP Help Portal - help.sap.com - or
download the PDF.
If we then go to the section on security the first topic mentioned are the changes
to the documentation and we can read that there
is a new chapter on data protection in the Security guide and a new chapter on
HANA XS advanced in the Checklists and Recommendations guide.
So, let's take a brief look at both guides.
Here we have our Security guide, it is about 274 pages,
and here chapter 10, data protection in SAP HANA,
a new chapter that explains the concepts, the SAP HANA approach
on data protection with a separate paragraph on the deletion of personal data.
For the rest, most of the Security guide is pretty much the same as with
the previous edition although, of course, you'll find some new
information about topics that have changed, for example, the new SAP HANA cockpit.
The SAP Security Checklists and Recommendations guide
is a bit shorter, it is about 36 pages, and here we have a new
chapter on HANA XS advanced model with recommendations for the XSA administration
user, organizations and spaces,
and network configuration.
So this whole section is new.
The other topics in the guides, for example, the checklist for secure handover,
or the different recommendations for the SAP HANA
database are roughly the same.
If security is important to you or your business make sure you're familiar with
this guide.
So, that's it for documentation changes and now let's take a look
what's new and changed for database Security.
Three sections: encryption, authorization, and, I already
mentioned it, security administration with the new SAP HANA cockpit.
For encryption, two bullet points: the HANA database now supports redo log
encryption - this is new - and there has been an
enhancement for encryption root key management, so this is changed.
Now what has changed is that your root key
management can now be done using SQL entirely, and there is a new system privilege
encryption root key admin that is required to change the root keys, and
finally, this is very convenient, you can now
create a backup of the root keys.
So how does this work?
For this, let's briefly consult the Administration guide,
chapter 7 Security Administration, and then paragraph 7.4 Managing Data
Encryption in SAP HANA.
Here we have an illustration that shows us the concept
the whole box is SAP HANA, on the left we have HANA running in-memory and
to right we have HANA on disk (or storage, or persistence) whatever you want
to call it.
So, we have data volume encryption, this was introduced with SPS 09,
about two years ago and now with HANA 2.0 we also have log volume
encryption.
Data volume encryption is done with a page key, which is generated by a
root key and both the root key for the data volume encryption and the log
volume encryption are stored in the instance SSFS.
Now as you can see, we have three root keys here
the green one for data volume encryption the blue one for the log volume encryption
and the orange one for security relevant application data,
for example, an application that wants to store credit card data in the HANA
database will use the application encryption service and is
generated by the root key stored in the instance SSFS.
Think of the SSFS as a safe - a safe stored on the file
system - hence the name secure storage on the
file system.
It's a technology also used with SAP ABAP systems.
There are two SSFS’s.
We got the instance SSFS and the system PKI SSFS.
In the second safe, root certificates for internal communication
are stored.
For example, communication between the processes hdbnameserver,
hdbindexserver, and so on, there are a couple of them,
but also when HANA is running as a distributed system, we have multiple
hosts communicating.
Other examples you can think of is for dynamic tiering
when we have the main memory store and the extended storage where the
communication can be encrypted, or, for example, when you use replication.
Now most of the internal communication encryption happens automatically,
there's not much to manage here, except of course, to change the SSFS master keys
at least, when you receive HANA as an appliance from the hardware vendor, or
when you use HANA express as a virtual machine.
This is all documented, of course, in the Security Recommendations guide
we just looked at, we see the whole flow documented here on how to go about system
handover.
So, if you're new to this topic you might want to take a look at this
section.
Then, if we return to our first illustration, I also have to mention the
new password protected backup of the root keys.
So this concerns the three root keys stored in the instance SSFS.
OK, let’s return to the release notes.
Next topic is authorization.
New is that you can now use an LDAP compliant Identity
Management Server to manage user authorizations and this works with group
membership.
There many different types of LDAP Identity Management Servers
out there, Microsoft Active Directory is probably the
most well known, SAP also has one, and there are open-source LDAP providers
and they all can be used.
This is documented the Security guide, LDAP group
authorizations, and basically what happens is that you grant roles mapped to
LDAP groups.
You create your LDAP provider using SQL.
Here we see the statement.
Then when you create your user you specify that the authorization is
performed by LDAP and then there's also a validate LDAP provider statement to
check if this is all working.
With a new view LDAP Users and the column
AUTHORIZATION_MODE added to the USERS view.
Also new is that you can now convert a restricted user into a standard user.
Restricted users were introduced with SPS 10 of HANA 1 and they do not have
the PUBLIC role so they cannot view data in the HANA database and also they do not
have the privilege to create objects in their own
schema because with restricted users the whole authorization is happening at the
application server layer and not at the SAP HANA database layer.
Now new in HANA 2.0 is that you can both grant or
revoke the PUBLIC role and grant or revoke the create object privilege in
one’s own schema and this allows you, in fact, to
convert a restricted user into a standard user.
Previously, you had to drop the restricted user and recreate it.
Finally, we have the topic security administration with the SAP HANA cockpit.
We already looked at it briefly, so now let's take a more closer look.
Here we have the new SAP HANA cockpit 2.0.
There's a separate video that will go into more detail about the cockpit itself.
Here we will focus just on the security aspects, so I will select this
link here, Security, which will bring us to the Security Overview page.
We have four tiles: one on data storage security; one on auditing; one authentication; and
one with security related links.
Some of the related links will open different apps, for example, to manage certificates.
There's also a link that will show your network security information.
For example, the cryptographic provider being used.
There is online documentation about using security administration with the SAP HANA
cockpit and there are also links to the SAP HANA security
website on sap.com, which is a great source of information with links
to white papers and other resources, like, for example, the SAP HANA Academy.
The security checklist link will open the checklist guide, we looked at previously.
Then for three main tiles, I will start with authentication.
Here we can see the last time the SYSTEM user password was
changed, whether single sign-on is configured, and what password policy is
active.
Select it and the password policy editor will be opened and here you can
configure your minimum password length, where to use lowercase or uppercase etc.
Now this hasn't really changed but what's important is that you can do it all over
the web the same for the password blacklist.
The auditing tile shows us whether it's enabled or not, what the audit trail
target is, and the number of enable or disable audit policies.
Select it and auditing app will open and here we can
configure the system settings for auditing or create or disable audit
policies.
Finally, we have the data storage security tile, we already talked about.
We see the last time the SSFS master key for both the instance
and the system PKI were changed.
We can enable data volume encryption here by toggling this
button.
It's not yet possible to enable log volume encryption using this tile
but my guess is that will be added soon and selecting the tile will show you
the status of data volume encryption.
Here you can change the root key and here you
can, provided your volumes are encrypted, decrypt them, or if they're decrypted you
can encrypt them.
Then also new, if we scroll up a little bit in the
administration section is that you can now select Manage Users to manage your
HANA user’s.
So you can, for example, reset the password, change authentication
settings, and you also can create a new user both standard and restricted.
That's it for the security features of the SAP
HANA cockpit and it also wraps up what's new with security for SAP HANA 2.0.
You can find more videos on our YouTube channel SAP HANA Academy.
If you subscribe, we will keep you updated.
IF you like, you can connect with us on LinkedIn, follow us on Twitter,
or keep track about what's new on our Facebook page and if you like this video give it
a thumbs up.
OK, thank you for watching.