Skip to content

How to master KRITIS/IT-Sig 2.0 for SAP

“KRITIS” is a pretty well-known abbreviation for “KRITische InfraStrukturen” (Critical Infrastructure) and is closely associated with the Federal Republic of Germany. The Federal Republic is attempting to make critical infrastructure resilient to cyber-attacks by proactively identifying vulnerabilities and implementing measures to protect attractive targets. 

Critical infrastructure includes areas and companies whose impairment or failure could cause significant economic damage. Outside of Europe, the protection of critical infrastructure is of course, also a highly critical issue. 

Companies that fall into this classification must comply with or face sensitive penalties. 

History of KRITIS

Before we look at KRITIS for SAP, – a brief history lesson. Back in 2006, the European Union launched an initiative for critical infrastructure protection. At that time, it was named the European Program for Critical Infrastructure Protection (EPCIP). This program has been continuously developed through several national and European initiatives. At a national level in Germany, the BSIG – “Law on the Federal Office for Security in Information Technology”, has laid the foundation for the regulation of critical infrastructure. Most recently, these efforts culminated in the IT Security Act 2.0, (IT-Sig 2.0).

Who counts as a KRITIS operator?

Generally speaking, companies providing critical infrastructures for the national community are considered as KRITIS operators. If a KRITIS company fails, sustainable supply problems can occur, and it is also difficult to guarantee public safety.

Until recently, 9 different sectors in Germany are considered to KRITIS. These include, for example, the energy, water, and food supply, telecommunications, and healthcare and finance sectors. The BSI KritisV (BSI Criticality Ordinance) specifies the threshold value, for example in terms of rated power in megawatts, at which a company is affected by the requirements. In the latest version 2.0 of the IT Security Act, waste management has also been included. In addition, there is a new category that includes all areas that are subject to a special public interest.

What is necessary for SAP KRITIS?

  • Incident & Response plans: What should be done in an emergency, by whom in what order?
  • Update of the SAP infrastructure: Hardening of SAP components, implementing patches, establishing a timely Patch Management process
  • Intrusion Detection System for SAP and SIEM Integration for SAP: Early warning systems for threat detection on SAP infrastructure (IDS) and central collection and aggregation of relevant logs for anomaly detection and automatic alerting using a SIEM
  • Disaster recovery scenarios: This is certainly nothing new but still red-hot: How can the operability of an SAP service be restored in the event of an SAP attack/disturbance?

Our recommendation if KRITIS applies to you

KRITIS or IT-Sig 2.0 is a law that, where applicable, everyone must abide by, so you can’t neglect it. Get professional support. We can recommend a specialist from our partner network who has the expertise to advise you on the necessary measures for SAP environments. Define a Disaster Recovery Plan and test the defined scenarios on a regular basis. Equally important is the creation of an Incident & Response playbook which is used in the event of an attack. Finally, you should of course do everything possible to prevent an SAP attacker from succeeding. You can do this by hardening your environment adequately according to your risk profile and by continuously checking that the measures are effective.

Certain risks cannot simply be eliminated. You must accept this. In this case, you should compensate with targeted monitoring using an intrusion detection system for SAP like the SecurityBridge Platform.

Posted by

Christoph Nagy
Find recent Security Advisories for SAP©

Looking into securing your SAP landscape? This white-paper tells you the “Top Mistakes to Avoid in SAP Security“. Download it now.

Webinar: Why is SAP Security Patching not like Windows Updates?

The webinar, taking place on demand is all about SAP Patch Management and its challenges. The German-speaking SAP User Group (DSAG) and the American colleagues of ASUG asked why SAP security patching cannot be as simple and effective as, for example, Windows updates.

SecurityBridge at the DSAG22: How to protect SAP systems during these times

Together with its partner, Fortinet, the SAP Security specialist company will present how to close the gap between SAP and network security in Leipzig.
SAP Security Services
SAP Cybersecurity- Security News
Many companies have recognized the need for SAP cybersecurity, but many have also realized that they cannot accomplish this alone. There are many reasons for this. It can be due to the internal teams' workload or due to the employee's level of knowledge. However, there is a solution that neither burdens your internal staff nor demands additional knowledge. A specialized managed SAP Security Service allows you to harden mission-critical systems, detect and promptly counteract non-compliance, and implement monitoring with accurate anomaly detection.
Patch Management
SAP security provider SecurityBridge—now operating in the U.S.—today announced the full integration of its SAP Security Platform with the Microsoft Sentinel cloud-native Security Information and Event Manager (SIEM) platform and its membership to MISA. SecurityBridge was nominated to MISA because of the integration of its SAP Controller to the Microsoft Sentinel dashboard. SecurityBridge is a Smart Data Adapter that significantly simplifies security monitoring of critical and highly specific business applications.
Angriffserkennung für SAP
SAP Cybersecurity- SAP Identity and Authorization- SAP Threat Monitoring- Security News
Viele unserer Leserinnen und Leser erinnern sich noch an den 25. Mai 2018, Stichtag der bindenden Einführung der Datenschutzgrundverordnung, kurz DSGVO. Verstöße gegen die neue Regelung können seitdem zu drakonischen Strafen führen. Nun steht, zumindest für diejenigen Unternehmen, die zur kritischen Infrastruktur (KRITIS) von Deutschland zählen, ein ähnlicher Termin ins Haus. Am 1. Mai 2023 müssen betroffene Unternehmen ein System zur Angriffserkennung eingeführt haben.
SAP Cybersecurity Risks
SAP Cybersecurity- SAP Security Framework- Security News
Recently, we gave an insight into the known SAP attackers in our blog. Of course, it can already be deduced from this that there are internal and external SAP attackers. That is why today, we want to look at this from an SAP cybersecurity risk perspective.