Case Study
Secure Remote Maintenance Freeway for SAP Systems
High reliability during operation and cost savings in service and support: The remote maintenance of SAP Systems provides considerable user benefits. However, risks need to be avoided during remote access by external experts and a very high level of protection must be ensured. A remote maintenance solution developed by genua together with SAP identifies new possibilities. It transfers a remote maintenance concept from the industrial sector to the SAP world.
SAP applications are part of the critical IT solutions used in almost all companies. When failures occur, they quickly have a negative impact on core business processes. The secure and reliable remote connection of the systems to SAP Support is therefore a top priority for SAP customers. Scheduled as well as unscheduled connections to systems can take place around the clock as proactive and reactive service, reducing time-consuming and expensive on-site deployments to a minimum.
Companies and government authorities with high security requirements receive the SAP Advanced Secure Support Services. These complement the Premium Services with additional measures to ensure compliance with high security standards and make the services even easier to use – especially in the area of remote maintenance. For example, this includes security-cleared support staff as well as special secure areas and rooms at SAP locations.
Continuous Improvement of IT Security
One Advanced Secure Support Services customer is Bundesdruckerei from Berlin. The company places great importance on comprehensive security and quality management.
"We actively implement IT security as it is the foundation of our business. So we are always on the lookout for solutions that can make our processes even more efficient and secure", says Christian Helfrich, Managing Director of Bundesdruckerei and responsible for IT, among other areas. In discussions with SAP management we came up with the idea to further optimize security in remote maintenance.
Setting the Benchmark in Remote Maintenance in the Industry
Helfrich was able to recommend the Bundesdruckerei subsidiary genua, which offers a highly secure remote maintenance solution for industrial production processes, among other things. This uses a rendezvous server, which is installed in a demilitarized zone (DMZ) next to the firewall. Both the customer as well as the remote maintenance service provider connect to this server at an agreed time. It is the rendezvous on the server that first creates the continuous maintenance connection. Service can use this to connect to the serviced machine in the corporate network. The customer therefore always has complete control of all remote maintenance access to their network.
"Together with SAP we faced the challenge of transferring the rendezvous concept for maintaining production environments to the remote maintenance of an SAP system", reports Matthias Ochs, Managing Director of genua, and continues: "The key aim was to seamlessly link the existing solution components provided by SAP and genua."
The Secure Remote Maintenance Freeway
Matthias Ochs from genua compares the solution to measures for a safe freeway: "Just as safety barriers, road markings, traffic signs, and speed limits work together to improve safety on freeways, the combination of security components with hardened operating systems and microkernel technology as well as high-quality encryption methods with genua Advanced Secure Connect creates a 'secure remote maintenance freeway'."
At the heart of the solution lies a hardware appliance, the genua Secure Connector. This is installed in the customer network’s DMZ. The rendezvous server and a VPN gateway (virtual private network) run on the genua Secure Connector. An in-house VPN gateway is also located in SAP Support’s data center. To ensure the smooth communication between the SAP and customer network, SAP has developed its own type of connection.
SAP Support creates an encrypted connection to the genua Secure Connector via the VPN gateway. The customer’s employee also establishes a connection to the connector at the agreed time. Once both parties have successfully verified their identity, they meet on the rendezvous server. Only once all these steps have been successfully performed can SAP Support access the serviced system in the network. High-quality methods are used to encrypt the maintenance connection, which have proven their worth in the government classified materials sector and which cannot be broken using the technology currently available.
Additional Security
The genua Secure Connector is equipped with a microkernel operating system. The low level of complexity of the software prevents errors in the code and therefore potential areas of attack. Furthermore, the operating system creates two strictly separated areas: one area for the systems to establish the VPN connection and a second for the SAP router protocol.
Matthias Ochs: "The separation technology creates a strong barrier against attackers. Because, even if they penetrate and manage to conceal malware in one area, the path to the other areas and, in particular, to the customer’s network is blocked."
Another security component is the Service Box. This is operated at the end point of the maintenance connection before the customer’s SAP system. The Service Box shields the serviced SAP system from the rest of the customer's network. This means that the remote maintenance access exclusively leads to the serviced system, access to other customer IT systems is not possible.
Seamless Tracking of Remote Maintenance Access
All SAP Support actions can be tracked live via the Central Management Station genucenter user interface. This administration solution can also be used to create and archive video recordings of the maintenance process. Finally, all log data are recorded. Customers can therefore always keep an eye on external access and can seamlessly track previous remote maintenance activities at any time if necessary.
Matthias Ochs concludes: "The rendezvous solution, additional security components, the control of the entire connection, and the comprehensive monitoring result in maximum security in remote maintenance. These functions enable us to meet the Federal Office for Information Security’s (BSI) requirements for securing remote maintenance in an industrial environment."
Bundesdruckerei Managing Director Helfrich explains the benefits from a customer perspective: "The remote maintenance of our SAP systems saves costs and ensures a high level of operational availability without making any compromises with regard to information security and data protection. We always want to retain complete control of our IT systems, which is precisely what genua Advanced Secure Connect offers."
Attractive Business Model
All Advanced Secure Support Services customers can use the new solution. The technical equipment for the highly secure remote maintenance infrastructure is provided by genua. This includes all the hardware and software components on a rental basis for three years. If the contract is subsequently extended, the hardware in use is replaced. The complete package also includes 24/7 support for the remote maintenance solution. This additionally includes regular software updates and a Next Business Day Replacement Service for the hardware: If a system fails, customers receive an identical replacement device the next business day.
Bundesdruckerei implemented the new SAP remote maintenance service as the pilot customer. Managing Director Helfrich says: "Unilateral steps in IT security do not lead to the goal. Rather, this requires a strategic and integrated approach. Co-innovations, as seen in the case of Advanced Secure Connect, are guiding us down the right path. We are convinced by the added value and benefits of the remote application solution."