The human factor as the key to SAP system security
As part of the “Safe Tuesday with SNOK” series, we present another article in our expert series dedicated to the cybersecurity of SAP systems. Today we focus on the most important, yet often overlooked, element of security - the human factor.
Enterprises invest significant resources in advanced cybersecurity solutions for their SAP systems - firewalls, threat detection systems and monitoring tools. Nevertheless, surprisingly often, breaches of SAP system security result from simple human error - clicking an unrecognised link in a hurry, reusing an old password, or improperly managing access rights.
The truth is that people are the most important element in cybersecurity, even though they are often underestimated. IT leaders who understand this can build an organisational culture in which good digital habits become second nature, supported by technology that makes it easier to stay secure.
Cybersecurity hygiene in the SAP environment: a daily practice
Much like personal hygiene, cybersecurity hygiene in SAP systems is about developing healthy habits, whereby small, consistent actions by employees adequately protect sensitive information. This includes verifying the sender before clicking on links in emails, locking the computer when stepping away from the workstation, not connecting unknown USB devices, and using different, strong passwords for every account in the SAP system.
The problem is that typical annual SAP cybersecurity training sessions with lengthy presentations are quickly forgotten by most employees, if they were paying attention at all. A better approach is to weave regular, short, interactive reminders into the daily work rhythm. Phishing simulations or weekly security tips work extremely well, because they focus not only on how to do something (e.g. recognise a fake email), but also on why it matters in the context of protecting SAP systems.
SAP security starts at the top
Building a security-conscious SAP culture starts with leadership. When managers and directors consistently use multi-factor authentication and share files securely, they set the standard. Employees notice this and are more likely to follow their example. In addition, recognising teams that perform well in security exercises helps turn SAP cybersecurity from just another mandatory regulation into something the whole team can take pride in.
Why complex passwords lose out to passphrases in SAP
Standard “complex passwords” full of symbols and random digits may seem secure, but they often lead employees to adopt poor practices in SAP systems, such as writing passwords down on notes, using similar passwords everywhere, or making minimal changes when forced updates occur.
Experts, including NIST, now recommend the use of passphrases. These are long strings of simple words, such as “Blue-guitar-autumn-lantern”. They are much easier for people to remember, but significantly harder for automated hacking tools to crack. When we combine passphrases with multi-factor authentication and simple account recovery methods, people are less frustrated and more inclined to follow SAP security rules.
Protecting SAP data on the move with hardware encryption
Even the most careful employee can lose a laptop or have a USB drive stolen. This is where hardware-encrypted media become an essential last line of defence, when other hygiene practices fail. Drives with built-in encryption automatically protect SAP data, preventing access by anyone without the appropriate credentials, even if they physically possess the device.
Unlike software encryption, which relies solely on software, hardware encryption is physically part of the drive and is not vulnerable to the same types of software attacks or brute-force password cracking. This is particularly important in the context of transporting SAP data between environments.
When choosing encrypted drives, it is worth looking for those certified by trusted organisations (e.g. FIPS 197 or FIPS 140-3 Level 3). This means they meet high encryption security standards. In addition, drives with digitally signed firmware are important, as they help protect against threats such as “BadUSB”, where malware attempts to infiltrate a device through compromised USB firmware.
A checklist for better cybersecurity hygiene in SAP
-
Know your sensitive SAP data: Determine which information requires the greatest protection and track where it goes.
-
Regular backups: Ensure you have reliable, separated backups of critical SAP data. This is your safety net against ransomware and other data loss.
-
Short, effective training: Use frequent, concise security reminders and exercises to maintain high awareness without causing fatigue.
-
Use hardware-encrypted media: Provide employees with secure, hardware-encrypted USB drives or external SSDs for data that must leave the network, and configure endpoint security to block unknown devices by default.
Advanced SAP cybersecurity technology remains extremely useful for closing security gaps, but it cannot fully cover the risk arising from everyday human habits. Organisations that take the time to develop the human aspects of security build a much stronger first line of defence. By providing clear guidelines, reinforcing them regularly, and delivering technology that supports good habits, companies can significantly reduce risk. Ultimately, employees who are aware of the importance of cybersecurity represent a very difficult barrier for attackers.
SNOK’s approach: putting people at the centre of SAP security
At SNOK, we understand that technology is only part of the SAP security equation. That is why we place particular emphasis on educating and supporting users in building correct security habits. Our approach to securing SAP systems always factors in the human element as a key part of the security strategy.
We have developed a comprehensive SAP security training programme that includes:
-
Micro-training - short, interactive training sessions delivered regularly, instead of long, annual presentations
-
Phishing attack simulations - safe tests that check employee vigilance and build proper habits
-
Contextual training - tailored to specific roles within the organisation, focused on real threats within SAP systems
-
Educational materials - accessible guides and instructions on SAP security best practices
Our SAP security management tools have been designed with users in mind - offering intuitive interfaces, clear messaging, and proactive support for making secure decisions. We believe that the most effective safeguards are those that support users rather than hinder their work.
At SNOK, we do not just deliver technology - we build a culture of security in which every SAP system user is a conscious and active participant in protecting the company against digital threats.