The foundation of a successful digital commerce business is a secure eCommerce platform. Cyber security involves conformity of protocols, intelligent detection of security loopholes, and proactive monitoring of systems. The security measures will span across browsers, applications, networks, and servers.

eCommerce security is built on three pillars: privacy, integrity, and authentication. In terms of cybersecurity, we can consider the following as the most important elements

• Secured Architecture -Application security, secure communication and data encryption
• Security Management – Administrative user access management, patch management
• Incident, threat and vulnerability management – continuous monitoring , vulnerability scanning and intrusion detection
• Data governance and legal compliance – Data protection management
• Cloud Continuity Management – IT service Continuity management

I. Web Application security 

Password Authentication and policies

SAP Commerce comes with a preconfigured, default set of users for use during development and demonstration. For security reasons, all default users are disabled and come with no preconfigured passwords. Only the main Administrator user password needs to be set beforehand to be able to build and initialize the system.  Define a temporary password initially to allow you to start SAP Commerce and get access to these systems (using Local. Properties file), then set a permanent, secure password for this user and any additional users and roles you may need once you log in.

SAP Commerce Platform always stores passwords in an encoded format, and it support multiple encoding strategies (known as password encoders). In addition, Business can implement its own strategies too. Currently, the SAP Commerce Platform ships with the following secure encoding strategies:

• Plain text: not safe, kept for backward compatibility
• MD5: not safe, kept for backward compatibility
• SHA-512
• PBKDF2: the strongest algorithm (default strategy in SAP Commerce)

SAP Commerce comes with two out-of-the-box password security policies called Regex and blocklist. Regex prevents users from using passwords that could be too easy to crack. Blocklist bans the most common passwords. You can implement your own policies too. SAP Commerce provides customizable extension points that enable fine-grained control of password handling

Data Protection and Privacy

SAP Commerce Cloud provides features to support compliance with relevant legal requirements surrounding data privacy. compliance with data privacy laws is not a product feature, SAP software supports data privacy by providing security some features. Data protection is associated with numerous legal requirements and privacy concerns and SAP Supports them with its’s frameworks

Customer Consent Management – Commerce B2C Accelerator provides functionality for data subjects (a natural person such as a customer, contact, or account) to give consent to collect or transfer their personal data.

Consent Logs– When a user gives or withdraws consent, a consent record is created in the back end and can be viewed in the Backoffice Administration

Information and Deletion 

SAP Commerce Platform provides functionality to retrieve all personal data stored about the data subject (person) in a machine-readable format from the system. On user request, the system owner can generate a list for a data subject, containing details about the personal data stored in the system.

SAP Commerce provides functionality to delete personal data on request by the data subject to accommodate the right of a person to be forgotten. Personal data can also be automatically deleted after a certain retention period

Please refer Data Protection and Privacy | SAP Help Portal  for more information.

PCI Compliance

The Payment Card Industry Data Security Standards (PCI DSS) help protect the safety of payment data for all entities that store, process, or transmit cardholder data. These standards set the technical and operational requirements for organizations accepting or processing payment transactions.

SAP Commerce Cloud operates according to the PCI DSS 3.2security standard. The PCI security standard requirements are listed, as well as the roles and responsibilities for both SAP and the Customer.

Please refer Data Protection and Privacy | SAP Help Portal  for more information.

Solr Security

The Solr security features include support for encrypting communication to and from Solr (as well as between the Solr nodes) using SSL and support for authentication and authorization provided by the Solr security frameworks. The security features are enabled by default when you use solrserver extenCommerce?Cloud sion.To enable secure communication using SSL, you need: a valid SSL certificate and also need to set SSL-related system properties.

When installing the Apache Solr, consider the following security considerations:

• While Apache Solr provides some security features, it is not recommended to expose it to the outside world. We should place the Solr servers in a demilitarized zone (DMZ) behind a firewall.
• Always use a secure client computer and web browser when using Apache Solr administration interface. Be mindful of the risk of CSRF attacks – always end the browser session and logout when done with your task, and avoid opening potentially corrupted web sites and emails while being authenticated with administration console.
• Follow standard hardening procedures for web applications, for example:
  • We should not run Solr servers as a root or with administrator privileges
  • Access permissions to configuration files and data files should be restricted
• If you index user-generated content like reviews or comments, then keep in mind that cross-site scripting (XSS) attacks are a risk if the search results are shown. To avoid this risk, the content needs to be escaped properly to prevent it from being wrongly interpreted.

Please refer Solr Security | SAP Help Portal for details .

Spartacus Security Best practices

While developing Spartacus storefront, wecan improve the security of storefront application by implementing the security best practices described in the following link

Please refer Spartacus Security

Note :  Please refer SAP Commerce Security for  complete information 

Cross-Origin Resource Sharing Support

SAP Commerce Cloud supports the Cross-Origin Resource Sharing mechanism. The CORS mechanism defines a way for a browser and a server to decide which cross-origin requests for restricted resources can or cannot be allowed.

Please refer Cross-Origin Resource Sharing Support | SAP Help Portal for Configuring and enabling the CORS  Support

Cross-Site Scripting (XSS)

XSS attacks are aimed at end users and are possible after a malicious code is sent to and executed by end users’ web browsers. This code can be sent in the form of a web page link or through a web application into which it was previously injected.Depending on the code’s purpose, it might enable the attacker to access the end users’ private information such as cookies or passwords they use in a given web application.

SAP provides two methods of protection against XSS attacks:

• Web Security XSS Filter protects against non-persistent XSS
• XSS Encoder protects against persistent XSS

Omni Commerce Connect Security

Security for OCC calls is provided by highly configurable Spring security mechanisms. OCC uses the OAuth2 protocol to simplify authentication and authorization. This enables long-term access to the principal and differentiates security rules based on the type of client application.

Please refer OCC Calls Security | SAP Help Portal for more detailed information.

Integration Security

Secure Integration API endpoints using OAuth or basic authentication, authorization, and SSL features. User groups and user roles provide security for defined groups and users.

Please refer Integration API Security | SAP Help Portal for more detailed information.

Unsecure Components

SAP Commerce contains unsecured components that you should secure or remove prior to moving into production. For e.g.

Mocks provided by SAP Commerce are not considered as secure and therefore should not be used in production.

Custom Extensions generated using SAP Commerce templates are not secured. Implementation team must ensure that security is taken into account when planning, designing, and implementing your custom extension.

Please refer Unsecure Components | SAP Help Portal

API Tokens -API tokens contain the user credentials that grant you access to Commerce Cloud APIs.You can generate an API token in the Cloud Portal.

Virtual Private Network (VPN) –Create up to 10 Virtual Private Network (VPN) connections to and from your SAP Commerce Cloud environments and your selected private networks using the Cloud Portal.

Commerce Cloud self-service Network Address Translation (NAT) is a specialized host-to-host networking feature that uses network address translation to extend the capabilities of a VPN.

With an IPsec VPN tunnel for SAP Commerce Cloud your site-to-site VPN traffic is encrypted/decrypted when it arrives at network gateways, ensuring more secure IP traffic and making VPN clients unnecessary. please refer IPsec VPN Tunnels   for more details

SAP Cloud Interconnect – SAP Cloud Interconnect gives the reliability and security of a dedicated connection while still maintaining the flexibility and fast deployment time of an Internet VPN connection. please refer SAP Cloud Interconnect for more details

Note: Please refer Cloud Portal Security section for the detailed information on the above listed security features

Security and data privacy on Commerce Cloud and Customer Data Cloud Integration

CDC Security Features are listed the following

• Ensure your data is secure with Risk Based Authentication
• Account Takeover/ Impossible Traveler Protection
• Identity Verification
• CAPTCHA

Trust & Compliance

Build trustful and compliant relationships

-Trust and transparency with Consent and explicit Opt-ins

-Comprehensive Self-service Preference Center

-Ensure compliance with privacy and data usage policies and with Consent Vault, Consent Data Enforcement, Double Opt-in Management and Automatic Version Control

-Out-of-the-box integration with fraud management partners

Please refer Registration as a Service | SAP Help Portal  for more details .

Also refer the blog for more details on Commerce cloud and customer data cloud integration

Integration between SAP Commerce and Customer Data Cloud | SAP Blogs