DB-01

Control Description

HANA database user accounts are configured to enforce password parameters (complexity, history, minimum length, expiration, lockout) per company policy, verified via HANA Cockpit or HANA Studio.

Risk

Failure to enforce strong password parameters at the HANA database layer may result in unauthorized database access, enabling direct data manipulation, fraud, or circumvention of application controls

Implementation Details

Enterprise SSO Integration
• To minimize reliance on local passwords, primary administrative access can be via SAP HANA Cockpit or client tools is secured using enterprise Single Sign-On (SSO), typically implemented via SAML 2.0 integrated with a corporate Identity Provider (e.g., Azure AD/Entra ID, Okta etc)
• This allows administrators to log in using corporate credentials and multi-factor authentication (MFA).

Fallback Password Governance:
• Global password security rules are configured directly within the SAP HANA database environment for fallback, emergency break-glass, and technical service accounts where SSO does not apply.

System Parameters: Parameters are set to match corporate policy baselines:

• Minimum length: Enforces a mandatory character floor (password_min_length).
• Complexity: Requires a mix of character types (uppercase, lowercase, numbers, special characters).
• Expiration and History: Governs password validity (password_lifetime) and prevents the reuse of recent passwords (password_exclude_current).
• Lockout: Automatically locks accounts after a specified threshold of consecutive failed login attempts (failed_connect_attempts).

Test Procedures

Test of Design (ToD):

• Inquire of database administrators and security management to understand the authentication architecture, including how SSO is configured for administrative tools (like SAP HANA Cockpit) and how local password baselines are established for fallback accounts. Inspect corporate security policies to confirm explicit requirements for SSO usage and password hardening.

Test of Operating Effectiveness (ToE):

• Verify SSO implementation by inspecting identity provider configurations or system authentication settings in SAP HANA Cockpit to confirm external identity federation is active for administrative users.

• Obtain a configuration export from SAP HANA Cockpit, Studio, or via direct system views to verify that active local database password parameters meet or exceed corporate policy requirements.