Advanced security using Amazon Services for RISE with SAP

Stateful Firewall Capabilities. Amazon Network Firewall offers advanced stateful firewall features to monitor and control network traffic. It can inspect the complete context of a network connection, including source, destination, ports, and protocols, to detect and block malicious or unauthorized traffic.

Threat Signature Matching. Amazon Network Firewall comes pre-loaded with a comprehensive set of threat detection rules and signatures, continuously updated by Amazon, to identify and mitigate known threats, malware, and other malicious activity targeting RISE deployments.

Custom Rule Definition. In addition to the pre-defined threat signatures, customers can create and deploy custom firewall rules to address specific security requirements or policies unique to connections hitting SAP systems in the RISE environment.

Centralized Policy Management. Amazon Network Firewall allows to define and manage firewall policies centrally, which can then be easily deployed across multiple VPCs including non-SAP VPCs and VPCs associated with the SAP-managed RISE VPC, ensuring consistent security enforcement.

Scalability and High Availability. As a fully managed service, Amazon Network Firewall automatically scales to handle changes in network traffic volume and patterns, ensuring RISE environment remains protected without the need for complex infrastructure management.

Centralized Firewall Management. Amazon Network Firewall provides a centralized, managed firewall service to control and monitor network traffic travelling to and from the SAP-managed RISE VPC.

Stateful Packet Inspection. Amazon Network Firewall performs stateful packet inspection, allowing it to detect and mitigate advanced threats by analysing the context of network connections to/from SAP systems within the RISE VPC.

Regulatory Compliance. Amazon Network Firewall helps organizations meet compliance requirements by enforcing security policies and providing logging/auditing capabilities for the RISE with SAP landscape.

as a RISE customer, backups can be copied from the SAP-managed Amazon account to a customer-managed environment and S3 bucket.

SAP data can be extracted from or a RISE environment (see Architecture Options for extracting SAP Data with Amazon Services) to a customer-managed S3 bucket, to enable advanced analytics, machine learning, and business intelligence using other Amazon services like Amazon Athena, Amazon Glue, and Amazon Sagemaker;

Certain industries and regulations, such as GDPR, HIPAA, or PCI-DSS, may require long-term storage and preservation of sensitive data. Exporting this data to a customer-managed S3 can help meet these compliance requirements, as S3 provides robust security and durability features.

Centralized Policy Management. Amazon Network Firewall allows to define and manage firewall policies centrally, which can then be easily deployed across multiple VPCs including non-SAP VPCs and VPCs associated with the SAP-managed RISE VPC, ensuring consistent security enforcement.

Customers can also consume security event logs out of their RISE environment, so ingest in their own S3 buckets or SIEM systems.

Amazon CloudTrail Logs: Amazon GuardDuty monitors API activity across Amazon account to detect suspicious API calls, unauthorized deployments, and unauthorized access attempts to resources. Amazon GuardDuty identifies attempts to access Amazon services from unauthorized IP addresses or regions. Amazon GuardDuty detects unusual behaviour in Identity and Access Management (IAM) users, roles, and policies, such as privilege escalation.

VPC Flow Logs. Amazon GuardDuty analyses network traffic within a Virtual Private Cloud (VPC) to detect unexpected traffic patterns, data exfiltration attempts, or unauthorized access alongside identifying communications between Amazon resources and known malicious IP addresses or domains. In the context of RISE with SAP on Amazon, the inspection takes places on a VPC fronting the RISE SAP-managed account;

DNS Logs. Amazon GuardDuty monitors DNS queries made by an Amazon resource to detect attempts to connect to malicious domains or unusual DNS request patterns. Amazon GuardDuty also detects the use of Domain Generation Algorithms (DGA) for generating domain names associated with Command and Control servers.

Intrusion Detection: GuardDuty enables early detection of intrusion attempts into an RISE environment fronted by a customer-managed Amazon account by identifying malicious activities such as unauthorized API calls, network reconnaissance, and access attempts from known malicious IP addresses;

Compliance Validation: For organizations with stringent compliance requirements, GuardDuty helps ensure adherence by continuously monitoring for policy violations and unauthorized access attempts, providing detailed logs and reports for audit purposes. This can be achieved when the SAP RISE environment is accessed from a customer-managed Amazon account. See Compliance Validation for more details

Automated Incident Response. GuardDuty can be integrated with Amazon Lambda and Amazon Security Hub to automate incident response workflows. Upon detecting a threat, these services can trigger automated remediation actions, such as isolating compromised resources or notifying security teams.