• Inadequate restrictions on what authenticated users are allowed to do.

• Security vulnerabilities where applications fail to properly protect sensitive data through adequate encryption leading to sensitive data exposure. This can be weak cryptographic standards or misconfigured TLS settings.

• Broad class of security vulnerabilities where an attacker can inject malicious data into a program or system, which then gets executed or processed by that system. This can result in unauthorized access to data, data loss, or even complete takeover of the system. Examples include SQL Injection, Cross-Site Scripting, Command Injection, LDAP and XML injection.

• A new category focusing on design flaws and missing security controls.

• Common issues due to insecure default configurations, incomplete setups, etc.

• Use of unsupported or out-of-date software components.

• Expanded from ‘Broken Authentication’, focusing on flaws in user identity management.

• New category about assumptions in software updates, critical data, and CI/CD pipelines.

• Inadequate logging and insufficient monitoring of security events.

• New addition focusing on server-side software making unvalidated HTTP requests.

Within the SAP Business Technology Platform (SAP BTP), several components and protocols play a crucial role. These include the App Router, API Management service, Identity Authentication Service (IAS), Identity Provisioning Service (IPS), OAuth 2.0 protocol, and OpenID Connect protocol.

1.     App Router

• Role-Based Access Control (RBAC): Enforces RBAC at the application level, ensuring users access only authorized parts.
• Route to Services Based on User Roles and Privileges: Routes requests to backend services based on each user’s specific roles and privileges.

2.     API Management

• API-Level Security: Defines security policies for APIs, controlling access and conditions.
• OAuth 2.0 Integration: Secures API access with OAuth 2.0, ensuring only authenticated users access endpoints.

3.     Identity Authentication Service (IAS)

• Centralized Authentication: Provides a central mechanism for application and service access, restricting access to authenticated users only. The service can support delegated and federated authentication to customer specific IDP
• Identity Provider Integration: Enhances security by supporting integration with external providers using SAML and OpenID Connect protocols.

4.     Identity Provisioning Service (IPS) and Identity Access Governance

• Automated User Management: Automates user provisioning and de-provisioning across cloud and on-premises applications within SAP BTP.
• Role and Access Synchronization: Synchronizes roles and access rights across systems, ensuring consistent control.

5.     OAuth 2.0

• Delegated Authorization: Enables applications to access services on behalf of users without needing credentials (delegated authorization).
• Access Tokens: Provides applications with access tokens for controlled access to APIs and services, based on granted scopes.

 6.     OpenID Connect

• Authentication Layer on Top of OAuth 2.0: Adds an identity layer over OAuth 2.0, providing additional user authentication information.
• ID Tokens: Issues ID tokens alongside OAuth 2.0 access tokens, containing authenticated user information, enhancing access control further.

• TLS for Data in Transit: SAP BTP utilizes Transport Layer Security (TLS) to encrypt data transmitted over the network, preventing eavesdropping and tampering. (Image of Data in transit encryption process.). SAP BTP supports TLS1.2 and above encryption protocol.
• Encryption of Data at Rest: Sensitive data stored within SAP BTP services, such as databases and file storage, is encrypted using industry-standard algorithms to safeguard it against unauthorized access. (Image of Data at rest encryption process.)

2.     Secure Key Management

• Centralized Key Management Service: SAP BTP provides a dedicated service for managing cryptographic keys, ensuring secure storage, regular rotation, and strict access control of encryption keys. This is facilitated by SAP Data Custodian Key Management Service available for SAP HANA Cloud, SAP Analytics Cloud (Private Edition). This is a additional service that can be integrated with SAP BTP services in scope. SAP also maintains credential store for storing cryptographic materials.

 3.     Secure Cryptographic Algorithms

• Use of Strong Algorithms: SAP BTP employs robust, industry-standard cryptographic algorithms for encryption, hashing, and digital signatures. These algorithms offer strong protection against known and emerging cryptographic attacks.

4.     Compliance with Security Standards

• Adherence to Security Best Practices and Standards: SAP BTP complies with recognized international security standards such as FIPS-140 for the cryptographic modules and libraries. This compliance assures high levels of data protection and promotes trust among users.

5.     Secure Communication Protocols

• Enforced Secure Protocols: The platform enforces the use of secure communication protocols, such as HTTPS, for all data exchanges. This reduces the risk of data being intercepted or manipulated during transmission.

6.     Access Control

• Fine-Grained Access Control: SAP BTP implements strict access control measures, ensuring that only authorized personnel have access to sensitive data and encryption keys. This granular approach minimizes the risk of unauthorized access and data breaches.

• Input Validation: SAP API Management includes features for validating input data. It can enforce checks on the inputs sent to APIs, ensuring they meet the expected format and type, thus preventing injection attacks.
• Policy-Based Access Control: It allows defining and enforcing policies that can restrict what types of calls and operations can be performed through the API, reducing the attack surface for injection.
• Rate Limiting and Quota Management: By controlling the rate and volume of API calls, SAP API Management can prevent or mitigate the impact of certain injection attacks, such as those trying to flood the system with malicious requests.

2.     AppRouter

• URL Rewriting and Redirection Safeguards: AppRouter can rewrite and redirect URLs in a secure manner, ensuring that untrusted input doesn’t lead to malicious destinations or actions.
• Authentication and Authorization: It handles user authentication and authorization, ensuring that only properly authenticated and authorized users can access certain functionalities, thereby limiting the potential for malicious injection.

3.     Secure Software Development Lifecycle Approach

• Prepared Statements and Parameterized Queries: For services interacting with databases, using prepared statements and parameterized queries is a key defense against SQL injection. This ensures that user input is treated strictly as data, not executable code.
• Content Security Policy (CSP): Implementing CSP in web applications can help prevent certain types of injection attacks, like XSS (Cross-Site Scripting).
• Regular Security Scanning and Auditing: Continuous monitoring and regular security audits can help in early detection of vulnerabilities, including potential injection flaws.
• Secure Coding Practices: SAP encourages and facilitates secure coding practices, which include proper input validation, sanitization, and the use of frameworks that inherently reduce the risk of injection.
• Educational Resources and Training: SAP provides resources and training for developers to understand and prevent security vulnerabilities, including injection attacks.

• Secure Defaults: SAP BTP is designed with security-focused default configurations, reducing the risk of misconfigurations that can lead to security vulnerabilities.
• Guided Configuration: The Integration Advisor provides guided configuration steps, helping users to accurately configure integration scenarios. This reduces the risk of security misconfigurations which can occur due to manual errors or misinterpretation of settings.
• Secure Credential Store: SAP provides secure store that allows developers to store signing keys and certificates securely within the platform.
• Best Practice Templates: It offers pre-defined configuration templates that are aligned with security best practices. This ensures that integrations are set up securely right from the start, minimizing the likelihood of introducing vulnerabilities.
• Custom Mapping Recommendations: By analysing business context and requirements, the Integration Advisor can suggest custom mappings and configurations that adhere to security standards, further reducing the risk of insecure setups.
• Secure Software Supply Chain, Regular Scanning and Updates, Compliance with Security Standards, Regular Security Audits
• Multi-Factor Authentication (MFA): Provides robust authentication mechanisms, including MFA, to strengthen user authentication processes.
• Single Sign-On (SSO): Supports SSO capabilities, reducing the risk of authentication failures due to multiple credential management. Support for SAML 2.0, Open ID, OAuth 2.0
• Secure Software Development Lifecycle (SSDLC) at SAP SSDLC Integration: SAP incorporates SSDLC practices throughout the development process of its products, including SAP BTP. This means security is a priority at every stage, from design and development to deployment and maintenance.
• SAST and DAST
• Provides black box security testing.
• Scans a running application.
• Finds vulnerabilities in the final solution (prior to delivery)
• Ensures high-quality security validation before delivery.
• Can discover runtime and environment-related issues.
• Typically scans Web applications and Web services.
• Provides white box security testing.
• Scans source code
• Prevents vulnerabilities early in the security development lifecycle (SDLC)
• Fully integrated into development process, hence highly effective vulnerability preventions
• Continuous Security Assessment: As part of the SSDLC, SAP conducts continuous security assessments to identify and mitigate potential vulnerabilities early in the development process.
• Security Training for Developers: SAP ensures that its development teams are trained in secure coding practices, staying updated with the latest security trends and threats.
• Security by Design: By adhering to the principles of ‘security by design’, SAP integrates security considerations into the software architecture from the ground up, reducing the likelihood of vulnerabilities.
• Contractual Assurances  Data Protection and Compliance: SAP provides contractual assurances to its customers regarding data protection, privacy, and compliance with relevant regulations (like GDPR, HIPAA).
• Transparent Security Practices: SAP maintains transparency in its security practices, providing customers with detailed information on how their data is protected.
• Regular Audits and Certifications: SAP undergoes regular external audits and obtains certifications to validate its adherence to high security and data protection standards.
• Technical and Organizational Security Measures: These measures include a comprehensive set of policies, processes, and technologies that SAP implements to ensure the security of its software and protect customer data.
• SAP Cloud Identity Services – A suite of services for user authentication and lifecycle management
• SAP Authorization and Trust Management Service – Manage application authorizations and trust for SAP BTP
• Platform Authorizations Management API  – Functionality for subaccount members managing.
• SAP Connectivity Service – Manage destinations and securely connect to on-premises systems.
• SAP Credential Store Service – Managing passwords and keys.
• Audit Log Retrieval API – Functionality for retrieving audit logs.
• SAP Malware Scanning Service – Scan business documents uploaded by your custom-developed applications for malware.

1.     Comprehensive Logging

• Detailed Activity Logs: SAP BTP maintains detailed logs of all activities, including user actions, system events, and errors. This helps in identifying suspicious activities and potential security incidents.
• Audit Trails: Audit trails are kept for critical operations, providing a clear record of who did what and when, which is crucial for security audits and investigations.
• Audit Log Retrieval API – Functionality for retrieving audit logs.

2.     Real-time Monitoring and Alerting

• Continuous Monitoring: The platform continuously monitors for unusual activities and potential security threats. This includes monitoring of network traffic, user activities, and system performance. This is being performed by SAP Security Operations.
• Automated Alerts: In case of suspicious activities or identified threats, the system generates automated alerts, enabling rapid response to potential security incidents. This is internally managed as a part of SAP BT Security Operations.

3.     Security Information and Event Management (SIEM) Integration

• Integration with SIEM Tools: SAP BTP can integrate with Security Information and Event Management (SIEM) tools, allowing for advanced analysis of log data, correlation of events, and more effective detection of potential security issues.

• Input Validation and Sanitization: SAP BTP employs stringent input validation and sanitization to ensure that URLs and other input data are valid and do not contain malicious content. This is crucial in preventing attackers from injecting malicious URLs that could lead to SSRF.
• Network Segmentation and Access Controls: By segmenting networks and enforcing strict access controls, SAP BTP limits the ability of a server-side application to make requests to unauthorized or sensitive internal resources, reducing the risk of successful SSRF attacks.
• URL Allowlisting: SAP BTP supports URL allowlisting, where applications can only communicate with a predefined list of safe and approved external services or domains, preventing requests to potentially harmful URLs.
• Many of the controls explained for App Router and API Management will apply to mitigate this vulnerability.