Hello and welcome to the SAP HANA Academy.
My name is Denys van Kempen and in this
video tutorial series will discuss
what's new with SAP HANA SPS12.
The topic of this video is security.
There are a number of new features added
to SAP HANA for SPS
support package stack 12. Some are minor.
There are some new system views. There
are some new roles and others are more
apparent.
For example added functionality to the
SAP HANA cockpit. I have listed them here
and will briefly discuss them and show
you how it works in a live system.
All these features improve the usability
of the SAP HANA cockpit and support
administration of SAP HANA
from the web. Here I'm comparing two
screenshots of the SAP HANA cockpit SPS
11 and SPS 12. Upon first view the network
security information, data storage
security and auditing tasks have not
changed and only the authentication tile
has been at it. However new is that the
auditing tile for example in SPS 12 now
opens an auditing app and this allows
you to configure auditing into the SAP
HANA security overview group and take a
look at the data storage security tile.
If we select the tile this will present
us the encryption state of services.
Services are the index server for
example or the XS engine. New in
SPS 12 is that not only can we encrypt
data volumes from this location but we
can also change the route encryption key
and to support this change two new
columns have been added whether a root
key change is pending and the current
version of root key. Now for those not
familiar with data volume encryption
and root keys this illustration is from
the security guide. Here we can see we
have a secure storage on the filesystem
SSFS that is protected by the SSFS
master key and inside that store we find
a data volume encryption root key and
the internal data encryption services
root key. The internal data encryption
service for example
protects the secure credential store and
the XS secure store. Whereas the data
volume encryption root key protects safe
point specific page keys and these are
all stored in the HANA database. This is
not new. So if you're not familiar with
these topics you can read about it in
the security guide for the concept. Data
volume encryption has been around for a
while support package stack 8, if not
mistaken and you can use SAP HANA
Studio to enable it. Select the
security editor in the systems view and
then under the data volume encryption
tab you can select the box encrypt data
volumes and execute. This functionality
has been web enabled in support package
stack 11. However new in 12 is that we can
also change the root key. Note that there
is no option to change the data volume
encryption root key in SAP HANA Studio.
For this you would need to use a
command line tool hdbnsutil
and how to use this tool is described in
the administration guide but in SPS 12
it's no longer needed to use a command
line tool for this as we can do it from
the web. That's number one change the
root encryption key for data volume
encryption. Number two is auditing.
Now as you can see the tile itself is
not new. It shows the status of auditing
on or off. The number of out of policies
enabled and the audit trail target and
when selected in SPS 11 we can view any
configured audit policy and we can view
the configuration of auditing. To change
auditing in SPS 11 you would have to
go to HANA Studio again. Same security
editor but now select the auditing tab
and here you can enable auditing and set
the audit trail target and optionally
set audit level trail targets to be
different. For example other level alert
goes to the database and audit level
critical goes to sys log. Also to make
changes to the audit policy you would
use to security editor. Give the policy
a name and at the actions to be audited.
Now I'm showing you here certificates
and the PSE store. These
new auditing actions one example of
minor enhancements. Now in SPS 12 we can
configure auditing from the cockpit. SAP
HANA Studio is no longer needed
for this. We can enable auditing. We can
set the audit trail target and also
optionally the target for the audit
levels alert emergency and critical. Same
for audit policy details. We’ll take a
look at a live system in a moment. This
is just for your overview and that's
number two configuration of all the
thing for SAP HANA has been fully web
enabled. Everything can be done from the
SAP HANA cockpit. Number three is
authentication. There's a new tile
it displays the password policy and any
SSL configuration you've configured.
Prior to SPS 12 password policy
configuration again was done in SAP HANA
Studio security editor password policy
tab and here you can define password
length and composition, user lock
settings, number of last use passwords
the lifetime of passwords, etc and also a
password blacklist. For example if you do
not want anyone to use my password, as
password, you can specify that here. New
and SPS 12 is that no longer do we need
HANA Studio to do this. We can do it in
SAP HANA Cockpit same functionality but
now fully web enabled. Both for password
policy and password blacklist. So let's
take a look at a live system. Here I'm
connected to SAP HANA Cockpit of an SPS
12 system and if we scroll down a bit we
see here our SAP HANA security overview
group with the four tiles we discussed.
If we start with authentication we see
we now have an edit button we can select.
We can for example set the minimum
password length to 15 and at the entry
welcome1 to our password blacklist. Save
it and we can see our new value for
minimum password length and welcome1
on the black list and when we return to
our home page we can see that we now
have a
customized password policy. Selecting the
auditing tile will open the auditing app.
Create audit policy will allow you to
create a new policy and for example I
will add PSE here and at the actions
create, alter and drop PSE certificate
collections to this policy. Save it and
the policy will be started SAP
database and for your convenience the
SQL statement that defines this policy
is also listed here. After you have
created a policy. Of course you can edit
it or delete it. Just click the red cross
and to edit it select it and use the
edit button to make any changes. The
actions create and drop schema are also
new for SPS 12. So much for create audit
policy. Once you have created your policy
of course it's important that you can
also enable it. So this we do here. Change
the system settings for auditing.
Optionally you can set the overall audit
trail target. I will leave it here to the
database table which is default but
optionally you can specify a different
target for the different levels alert,
emergency and critical. Select save and
the settings will have been saved and if
we return to our home page we can see
that auditing has been switched on with
two audit policies active. Finally we
have the data stores security tab which
now includes the possibility to change
the route encryption key. A confirmation
is required and it will be changed after
the next safe point. SAP HANA route keys
are defined at installation time. So if
you perform your own installation you
will have a unique key and you can maybe
change it. If you switch from the testing
phase to production but more importantly
customers who receive SAP HANA as an
appliance from an hardware vendor are
recommended to change the route keys.
Once they take ownership of the
appliance. If we didn't have changed the
root decryption key we can encrypt our
data volumes and depending of course on
the size of your data value
this will take some time and if we
then return to our home page we can
see on the tile the last time we've
changed our master keys and that data
encryption is running. So much for there
has to be HANA Cockpit. Then we have some
minor changes. We have a new view
encryption root keys and if we execute
it we can see the version and create
timestamp of both the persistence and
the DPAPI key and there's a new view
effective role grantees. Which requires a
where clause and here I'm looking at the
SAP HANA security cockpit roles maintain
audit policy and maintain password
policy. Both are new for SPS 12. In this
view allows you to see both the grantee
and the grantor of the role. So which user
or role currently has this role and who
gave it. Also new is effective privileged
grantees and this requires a where
clause on privilege and object type. So
for example I'm looking here at the
system privilege ini file admin and
again I can see who's the grantee and
who is the grantor. Two new privileges
have been added to SPS 12 as well
for SAP HANA admin roles and they are
solution manager monitoring and
restricted user DBSLAccess. The first one
contains a privileges required for the
solution manager technical user. In the
second one to use a restricted user as
the technical user for the NetWeaver
application server. Let's briefly recap
using the information from the SAP HANA
what's new guide. The release notes for
security administration with SAP HANA
Cockpit we have seen that the tile
catalog as a SAP HANA security overview has
a new tile authentication. This tile
indicates the status of the password
policy and any single sign-on
configuration and it opens the password
policy and blacklist app and that app
allows you to view and edit the password
policy and blacklist of your SAP HANA
database. Auditing app now allows you to
configure auditing, enable, disable,
configure audit trail targets, as well as
create, change and delete audit
policies for which you can see the
underlying
create audit SQL statement and the
data volume encryption app now allows you
to change the root key which you can
query with the encryption root keys
view. For authorization they're new to
system views, effective privilege
grantees and effective role grantees
into new roles solution manager monitor
and restricted user DBSLAccess. Also
mentioned here is that the authorization
component of the database trace has been
enhanced for easier troubleshooting of
authorization issues. Authentication was
not discussed but it's now possible to
disable authentication mechanisms that
are not used in your environment. So new
parameter for that authentication
methods which is defined in the global
.ini configuration file. SAP HANA
Smart Data Access now supports single
sign-on with Kerberos 5 and Microsoft
Windows Active Directory for connections
to SAP HANA remote sources.
Therefore encryption it's now possible
to change the root key used for data
volume encryption using the SAP HANA
cockpit. We looked at that and there's
also an SQL command to do this all our
system persistence encryption create new
root key. Client certificate validation
support has been added to SAP HANA Studio.
So if you open the properties for
your connection enable connect using SSL.
Then on the additional properties tab
you can use a private key for client
validation. This is all documented in the
SAP HANA administration guide. Also some
enhancement to the SAP HANA user store,
the hdbuserstore, which in the past
only supported ODBC but now also
supports JDBC connections. Finally we
have auditing. We’ve looked at that
auditing support for management for
certificates and certificate collection.
Change in the delatation of schema and
there's also a change of the data volume
encryption root key. As this now can be
done using SQL or the SAP HANA Cockpit. We
need to of course to audit it as well.
Cross database queries in SAP HANA
Multitenant Database containers are now
audited in the tenant database in which
query is executed
and a new parameter auditing
configuration audit statement length
allows you to configure the maximum
length of a statement. The default value
sets no limit and of course changing it
might compromise your audit lock. So use
this with care. For more information
about the concepts take a look at the
SAP HANA security guide. For SPS 12 a new
guide has been added to the library. The SAP
HANA security checklist and
recommendations guide. This used to be a
paragraph in the security guide but the
topic has now been elaborated and has
been moved to a separate guide. How to
perform the different security related
topics is documented in the
administration guide. This illustration
comes from a security guide and tells you
where to find what information
conceptual information from the security
guide and then depending whether you are
looking at it from an administration
point of view or a developer point of
view you have the different guides that
document those activities. They also
important are the SAP security notes which
you can find on the Support Portal and
they will keep you updated with the
latest notes. For an introduction to the
topic of security for the SAP HANA
platform you can go to HANA.SAP.com
/ security and here you can find
security white papers, security blocks
and similar information. So much for
what's new SAP HANA
SPS 12 security. Thank you for watching
this SAP HANA Academy video.