Skip to content

How to master KRITIS/IT-Sig 2.0 for SAP

“KRITIS” is a pretty well-known abbreviation for “KRITische InfraStrukturen” (Critical Infrastructure) and is closely associated with the Federal Republic of Germany. The Federal Republic is attempting to make critical infrastructure resilient to cyber-attacks by proactively identifying vulnerabilities and implementing measures to protect attractive targets. 

Critical infrastructure includes areas and companies whose impairment or failure could cause significant economic damage. Outside of Europe, the protection of critical infrastructure is of course, also a highly critical issue. 

Companies that fall into this classification must comply with or face sensitive penalties. 

History of KRITIS

Before we look at KRITIS for SAP, – a brief history lesson. Back in 2006, the European Union launched an initiative for critical infrastructure protection. At that time, it was named the European Program for Critical Infrastructure Protection (EPCIP). This program has been continuously developed through several national and European initiatives. At a national level in Germany, the BSIG – “Law on the Federal Office for Security in Information Technology”, has laid the foundation for the regulation of critical infrastructure. Most recently, these efforts culminated in the IT Security Act 2.0, (IT-Sig 2.0).

Who counts as a KRITIS operator?

Generally speaking, companies providing critical infrastructures for the national community are considered as KRITIS operators. If a KRITIS company fails, sustainable supply problems can occur, and it is also difficult to guarantee public safety.

Until recently, 9 different sectors in Germany are considered to KRITIS. These include, for example, the energy, water, and food supply, telecommunications, and healthcare and finance sectors. The BSI KritisV (BSI Criticality Ordinance) specifies the threshold value, for example in terms of rated power in megawatts, at which a company is affected by the requirements. In the latest version 2.0 of the IT Security Act, waste management has also been included. In addition, there is a new category that includes all areas that are subject to a special public interest.

What is necessary for SAP KRITIS?

  • Incident & Response plans: What should be done in an emergency, by whom in what order?
  • Update of the SAP infrastructure: Hardening of SAP components, implementing patches, establishing a timely Patch Management process
  • Intrusion Detection System for SAP and SIEM Integration for SAP: Early warning systems for threat detection on SAP infrastructure (IDS) and central collection and aggregation of relevant logs for anomaly detection and automatic alerting using a SIEM
  • Disaster recovery scenarios: This is certainly nothing new but still red-hot: How can the operability of an SAP service be restored in the event of an SAP attack/disturbance?

Our recommendation if KRITIS applies to you

KRITIS or IT-Sig 2.0 is a law that, where applicable, everyone must abide by, so you can’t neglect it. Get professional support. We can recommend a specialist from our partner network who has the expertise to advise you on the necessary measures for SAP environments. Define a Disaster Recovery Plan and test the defined scenarios on a regular basis. Equally important is the creation of an Incident & Response playbook which is used in the event of an attack. Finally, you should of course do everything possible to prevent an SAP attacker from succeeding. You can do this by hardening your environment adequately according to your risk profile and by continuously checking that the measures are effective.

Certain risks cannot simply be eliminated. You must accept this. In this case, you should compensate with targeted monitoring using an intrusion detection system for SAP like the SecurityBridge Platform.

Posted by

Christoph Nagy
Find recent Security Advisories for SAP©

Looking into securing your SAP landscape? This white-paper tells you the “Top Mistakes to Avoid in SAP Security“. Download it now.

SAP Security Customer Event 2024 – Hosted by SecurityBridge, Accenture & bowbridge

The premier SAP Security Customer event is back and better than ever. We’re thrilled to invite you to our ‘Secure Together’ event, set against the breathtaking backdrop of the Euromast in Rotterdam, the Netherlands.

SAP for Internal Controls Compliance and Risk Management Conference

We are thrilled to join and sponsor the SAP for Internal Controls, Compliance and Risk Management European conference, returning for its 8th in-person instalment.
hacking
In SAP’s patch round of February 2022, an SAP Security Note was released with a CVSS score of 10/10 named, “Request smuggling and request concatenation in SAP NetWeaver, SAP Content Server and SAP Web Dispatcher”. This particular type of vulnerability is not common in SAP systems and therefore interesting to look at. As patching the SAP kernel executables is often not done promptly, we can expect this vulnerability present in the customer’s systems for quite some time.
code pc
In one of our recent articles, we pointed out the use of Access Control Lists (ACLs) to better manage access control. Below, we will show a practical example of how this can be done for inbound HTTP communication with the ‘Internet Communication Manager’ (ICM) component of an SAP system.
SAP Security Patch Tuesday 2024
For February 2024, 13 new Security Notes have been released and 3 have been updated. Lets look at some highlights, starting with the ‘HowNews’ notes.