“KRITIS” is a pretty well-known abbreviation for “KRITische InfraStrukturen” (Critical Infrastructure) and is closely associated with the Federal Republic of Germany. The Federal Republic is attempting to make critical infrastructure resilient to cyber-attacks by proactively identifying vulnerabilities and implementing measures to protect attractive targets.
Critical infrastructure includes areas and companies whose impairment or failure could cause significant economic damage. Outside of Europe, the protection of critical infrastructure is of course, also a highly critical issue.
Companies that fall into this classification must comply with or face sensitive penalties.
Before we look at KRITIS for SAP, – a brief history lesson. Back in 2006, the European Union launched an initiative for critical infrastructure protection. At that time, it was named the European Program for Critical Infrastructure Protection (EPCIP). This program has been continuously developed through several national and European initiatives. At a national level in Germany, the BSIG – “Law on the Federal Office for Security in Information Technology”, has laid the foundation for the regulation of critical infrastructure. Most recently, these efforts culminated in the IT Security Act 2.0, (IT-Sig 2.0).
Generally speaking, companies providing critical infrastructures for the national community are considered as KRITIS operators. If a KRITIS company fails, sustainable supply problems can occur, and it is also difficult to guarantee public safety.
Until recently, 9 different sectors in Germany are considered to KRITIS. These include, for example, the energy, water, and food supply, telecommunications, and healthcare and finance sectors. The BSI KritisV (BSI Criticality Ordinance) specifies the threshold value, for example in terms of rated power in megawatts, at which a company is affected by the requirements. In the latest version 2.0 of the IT Security Act, waste management has also been included. In addition, there is a new category that includes all areas that are subject to a special public interest.
KRITIS or IT-Sig 2.0 is a law that, where applicable, everyone must abide by, so you can’t neglect it. Get professional support. We can recommend a specialist from our partner network who has the expertise to advise you on the necessary measures for SAP environments. Define a Disaster Recovery Plan and test the defined scenarios on a regular basis. Equally important is the creation of an Incident & Response playbook which is used in the event of an attack. Finally, you should of course do everything possible to prevent an SAP attacker from succeeding. You can do this by hardening your environment adequately according to your risk profile and by continuously checking that the measures are effective.
Certain risks cannot simply be eliminated. You must accept this. In this case, you should compensate with targeted monitoring using an intrusion detection system for SAP like the SecurityBridge Platform.
Posted by
Looking into securing your SAP landscape? This white-paper tells you the “Top Mistakes to Avoid in SAP Security“. Download it now.
