CIS SAP HANA 2.0 Benchmark

This recommendation verifies that Latest SAP HANA Revision Is Installed on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

HDB version
# Should show latest SPS + revision
# Alternative:
hdbsql -U SYSTEM -j "SELECT VERSION FROM M_DATABASE"

# Apply latest SAP HANA revision:
# Download the latest revision from SAP Support Portal
# Run the resident hdblcm:
/hana/shared/<SID>/hdblcm/hdblcm --action=update --batch

This setting ensures that Listen Interface Is Restricted on the SAP HANA 2.0 in-memory database platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SAP HANA 2.0 in-memory database platform is essential for defense in depth.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='communication' AND KEY='listeninterface'"
# Should return: .global or specific hostname, NOT 0.0.0.0

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('communication', 'listeninterface') = '.global' WITH RECONFIGURE"

This recommendation verifies that SAP HANA OS Users Are Properly Configured on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i 'sapadm\|<sid>adm' /etc/passwd
# Verify SAP HANA OS users exist and have correct groups
id <sid>adm

# Ensure the <sid>adm user has restricted permissions:
usermod -s /bin/false sapadm
# Set strong password:
passwd <sid>adm

This recommendation verifies that SSL Is Enabled for Client Communication on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='communication' AND KEY='ssl'"
# Should return: ssl = on

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('communication', 'ssl') = 'on' WITH RECONFIGURE"

This recommendation verifies that SSL Certificate Validation Is Enabled on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='communication' AND KEY='sslValidateCertificate'"
# Should return: true

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('communication', 'sslValidateCertificate') = 'true' WITH RECONFIGURE"

This recommendation verifies that Strong Crypto Provider Is Configured on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='communication' AND KEY='sslCryptoProvider'"
# Should return: openssl or commoncrypto

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('communication', 'sslCryptoProvider') = 'openssl' WITH RECONFIGURE"

This recommendation verifies that SYSTEM User Account Is Deactivated on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT USER_NAME, IS_PASSWORD_ENABLED, IS_DEACTIVATED FROM SYS.USERS WHERE IS_PASSWORD_ENABLED='TRUE' AND USER_NAME='SYSTEM'"

hdbsql -U SYSTEM -j "ALTER USER SYSTEM DEACTIVATE USER NOW"
# Or set a very strong password and restrict usage:
hdbsql -U SYSTEM -j "ALTER USER SYSTEM PASSWORD \"<StrongPassword>\" NO FORCE_FIRST_PASSWORD_CHANGE"

This recommendation verifies that Minimum Password Length Is Set on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='password policy' AND KEY='minimal_password_length'"
# Should be >= 8

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('password policy', 'minimal_password_length') = '14' WITH RECONFIGURE"

This recommendation verifies that Password Lifetime Is Configured on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='password policy' AND KEY='password_lifetime'"
# Should be <= 90

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('password policy', 'password_lifetime') = '90' WITH RECONFIGURE"

This recommendation verifies that Account Lockout Threshold Is Set on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='password policy' AND KEY='maximum_invalid_connect_attempts'"
# Should be <= 5

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('password policy', 'maximum_invalid_connect_attempts') = '5' WITH RECONFIGURE"

This recommendation verifies that Password History Is Configured on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='password policy' AND KEY='last_used_passwords'"
# Should be >= 5 (password history)

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('password policy', 'last_used_passwords') = '10' WITH RECONFIGURE"

This setting ensures that PUBLIC Role Privileges Are Restricted on the SAP HANA 2.0 in-memory database platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SAP HANA 2.0 in-memory database platform is essential for defense in depth.

hdbsql -U SYSTEM -j "SELECT GRANTEE, PRIVILEGE, IS_GRANTABLE FROM SYS.GRANTED_PRIVILEGES WHERE GRANTEE='PUBLIC' ORDER BY PRIVILEGE"

hdbsql -U SYSTEM -j "REVOKE CREATE ANY ON SCHEMA PUBLIC FROM PUBLIC"
hdbsql -U SYSTEM -j "REVOKE SELECT ON SCHEMA SYS FROM PUBLIC"

This recommendation verifies that Powerful Roles Are Reviewed on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT GRANTEE, GRANTEE_TYPE, ROLE_NAME FROM SYS.GRANTED_ROLES WHERE ROLE_NAME='CONTENT_ADMIN' OR ROLE_NAME='MODELING'"
# Review users with powerful roles

hdbsql -U SYSTEM -j "REVOKE CONTENT_ADMIN FROM <user>"
# Grant least privilege roles instead:
hdbsql -U SYSTEM -j "GRANT <specific_role> TO <user>"

This setting ensures that DATA ADMIN Privilege Is Restricted on the SAP HANA 2.0 in-memory database platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SAP HANA 2.0 in-memory database platform is essential for defense in depth.

hdbsql -U SYSTEM -j "SELECT GRANTEE, PRIVILEGE, IS_GRANTABLE FROM SYS.GRANTED_PRIVILEGES WHERE PRIVILEGE='DATA ADMIN' OR PRIVILEGE='CATALOG READ'"
# Review users with DATA ADMIN privilege

# Remove DATA ADMIN where not required:
hdbsql -U SYSTEM -j "REVOKE DATA ADMIN FROM <user>"
# Grant specific object-level privileges instead:
hdbsql -U SYSTEM -j "GRANT SELECT ON SCHEMA <schema> TO <user>"

This recommendation verifies that Global Auditing Is Enabled on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='auditing configuration' AND KEY='global_auditing_state'"
# Should return: true

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('auditing configuration', 'global_auditing_state') = 'true' WITH RECONFIGURE"

This recommendation verifies that Audit Policies Are Defined on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT AUDIT_POLICY_NAME, IS_AUDIT_POLICY_ACTIVE, EVENT_STATUS, EVENT_ACTION FROM SYS.AUDIT_POLICIES"

hdbsql -U SYSTEM -j "CREATE AUDIT POLICY pol_system_config AUDITING ALL SYSTEM CONFIGURATION CHANGE LEVEL CRITICAL"
hdbsql -U SYSTEM -j "ALTER AUDIT POLICY pol_system_config ENABLE"

This recommendation verifies that Audit Trail Is Set to SYSLOG on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='auditing configuration' AND KEY LIKE '%default_audit_trail%'"
# default_audit_trail_type should be SYSLOG for centralized logging

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('auditing configuration', 'default_audit_trail_type') = 'SYSLOG' WITH RECONFIGURE"

This recommendation verifies that Logon and Privilege Events Are Audited on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT AUDIT_POLICY_NAME, EVENT_ACTION FROM SYS.AUDIT_POLICIES WHERE EVENT_ACTION LIKE '%CONNECT%' OR EVENT_ACTION LIKE '%GRANT%'"

hdbsql -U SYSTEM -j "CREATE AUDIT POLICY pol_logon AUDITING SUCCESSFUL CONNECT, UNSUCCESSFUL CONNECT LEVEL INFO"
hdbsql -U SYSTEM -j "ALTER AUDIT POLICY pol_logon ENABLE"
hdbsql -U SYSTEM -j "CREATE AUDIT POLICY pol_privs AUDITING ALL GRANT PRIVILEGE, REVOKE PRIVILEGE LEVEL INFO"
hdbsql -U SYSTEM -j "ALTER AUDIT POLICY pol_privs ENABLE"

This recommendation verifies that Data Volume Encryption Is Enabled on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='persistence' AND KEY='encryption'"
# Should return: true (data volume encryption)

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('persistence', 'encryption') = 'true' WITH RECONFIGURE"

This recommendation verifies that Log Volume Encryption Is Enabled on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='persistence' AND KEY='log_encryption'"
# Should return: true (log volume encryption)

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('persistence', 'log_encryption') = 'true' WITH RECONFIGURE"

This recommendation verifies that Backup Encryption Is Enabled on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='backup' AND KEY='encryption'"
# Should return: true (backup encryption)

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('backup', 'encryption') = 'true' WITH RECONFIGURE"

This recommendation verifies that Root Encryption Key Is Rotated on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='persistence' AND KEY='internal_encryption_root_key_status'"
# Review root encryption key status

# Rotate the root encryption key:
hdbsql -U SYSTEM -j "ALTER SYSTEM APPLICATION ENCRYPTION ROOT KEY CREATE"

This recommendation verifies that Secure User Store Is Reviewed on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbuserstore list
# Review stored credentials — verify no plaintext passwords
# Check for unnecessary key entries

# Remove unused secure store entries:
hdbuserstore delete <KEY>

# Add entries with proper credentials:
hdbuserstore set <KEY> <host>:3<inst>13 <user> <password>

This recommendation verifies that Configuration File Permissions Are Correct on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ls -la /hana/shared/<SID>/global/hdb/custom/config/
# Config files should be owned by <sid>adm
find /hana/shared -name '*.ini' -exec ls -la {} \;

chown -R <sid>adm:sapsys /hana/shared/<SID>/global/hdb/custom/config/
chmod 640 /hana/shared/<SID>/global/hdb/custom/config/*.ini

This recommendation verifies that Embedded HTTP Server Is Disabled on the SAP HANA 2.0 in-memory database platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SAP HANA 2.0 in-memory database platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='httpserver' AND KEY='embedded'"
# Should be: false (disable if not needed)

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('httpserver', 'embedded') = 'false' WITH RECONFIGURE"

This setting ensures that Public Hostname Resolution Is Restricted on the SAP HANA 2.0 in-memory database platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SAP HANA 2.0 in-memory database platform is essential for defense in depth.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='public_hostname_resolution' AND KEY='use_default_route'"
# Review hostname resolution config

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('public_hostname_resolution', 'use_default_route') = 'no' WITH RECONFIGURE"

This recommendation verifies that Regular Backups Are Configured on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT ENTRY_TYPE_NAME, UTC_START_TIME, STATE_NAME FROM M_BACKUP_CATALOG ORDER BY UTC_START_TIME DESC"
# Verify recent full and log backups exist

# Create a full data backup:
hdbsql -U SYSTEM -j "BACKUP DATA USING FILE ('/hana/backup/data/COMPLETE_DATA_BACKUP')"

# Schedule regular backups via cron or SAP HANA Cockpit

This recommendation verifies that Log Mode Is Set to Normal on the SAP HANA 2.0 in-memory database platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SAP HANA 2.0 in-memory database platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

hdbsql -U SYSTEM -j "SELECT KEY, VALUE FROM M_INIFILE_CONTENTS WHERE SECTION='persistence' AND KEY='log_mode'"
# Should return: overwrite (for log mode normal) or blank (log mode normal is default)

hdbsql -U SYSTEM -j "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('persistence', 'log_mode') = 'normal' WITH RECONFIGURE"