Network Security Infrastructure Setup

Setting up the network security infrastructure involves determining the appropriate placement of the network security appliances (such as firewalls and IPSs). It certainly requires knowledge about the architecture of the GK services (POS Server, POS Service, etc.) in the cloud. These services have separate instances created in the cloud for each enterprise.

The request and response flows for a GK service in a specific enterprise are illustrated in the figure below. It illustrates the flows passing through the security gateway and Azure Application Gateway in the enterprise VPC.

The Azure Application Gateway includes a web application firewall that will be used to protect GK web applications against web-based attacks including different types of injection attacks such as XSS and (No)SQL injection. The web application firewall also contains DDoS protection mechanisms. General information about the Azure Application Gateway can be found at https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-introduction.

The security gateway of each enterprise VPC is a unified network security appliance that contains an integrated firewall, Intrusion Prevention System (IPS), and IPsec or SSL/TLS-based VPN gateway. These kinds of security gateway can be found as next generation firewalls produced and sold by different companies.

The firewall in the security gateway is responsible for only allowing access from specific source IP addresses to specific URLs exposed by the GK services of the corresponding enterprise. In order to do this type of filtering, the firewall should support Layer 7 content filtering (URL filtering).

The IPS in the security gateway contains signatures to prevent known attacks to the HTTP servers and operating systems employed by the GK services. It should also contain specialized mechanisms to prevent DDoS attacks, specifically REST and XML-based DDoS attacks in this case, since the POS Server, POS Service and SDC provide REST endpoints to their consumers.

The VPN module in the security gateway is used to enable the VPN connection between SAP services and the CIS Enterprise Connector of the enterprise.

The proposed network security infrastructure setup above also protects the GK services deployed in one enterprise against insider attacks from GK services in another enterprise in the cloud. These insider attacks can be initiated by a potentially malicious administrator of the GK services of an enterprise. In this case, the traffic initiated by the malicious insider administrator from an enterprise service is routed by the Azure Application Gateway of the source enterprise to the Azure Application Gateway of the target enterprise. The traffic is passed/filtered through the security gateway of the source and target enterprise VPCs on its route to the target service.