What is SAP Security?

SAP Security is a balancing act for protecting the SAP data and applications from unauthorized use and access. SAP offers different tools, processes and measures for security check to protect these data. SAP security helps to ensure that users can only use the functionality of SAP which is a part of their job.

  SAP Industry Solutions   Apr 3, 2024   130  Add to Reading List

SAP Security is a balancing act for protecting the SAP data and applications from unauthorized use and access. SAP offers different tools, processes and measures for security check to protect these data. SAP security helps to ensure that users can only use the functionality of SAP which is a part of their job.

Security Concepts for SAP

Below are the main Security Concepts in SAP:

  1. STAD Data

Transaction codes are the front door to get the access to SAP’s functionality. STAD data provide security against unauthorized transaction access. Does it keep a record of information like who accessed certain critical functionality? And when? STAD data can be used to monitor, analyze, audit and maintain the security concept.

  1. SAP Cryptographic library

SAP Cryptographic Library is the default encryption product delivery by SAP. It is used for providing Secure Network Communication (SNC) between various SAP server components. For front-end components, you need to buy an SNC certified partner product.

  1. Internet Transaction Server (ITS) Security

To make SAP system application available for access from a web browser, a middleware component called Internet Transaction Server (ITS) is used. The ITS architecture has many built-in security features, such as to run the Wgate and Agate on separate hosts.

  1. Network Basics (SAPRouter, Firewalls and DMZ, Network Ports)

The basic security tools that SAP uses are Firewalls & DMZ, Network Ports, SAPRouter, etc. A firewall is a system of software and hardware components which define the connections that should pass back and forth between communication partners. SAP Web dispatcher and SAPRouter are examples of application level gateways that you can use for filtering SAP network traffic.

  1. Web-AS Security(Load Balancing, SSL, Enterprise Portal Security)

SSL (Secure Socket Layer), is a standard security technology for establishing an encrypted link between a server and client. With SSL you can authenticate the communication partners(server & client), by determining the variables of the encryption.

With sap cyber security, both partners are authenticated. The data transferred between the server and client will be protected so any manipulation in the data will be detected. In addition to that data transferred between the client and server is also encrypted. Enterprise portal security guide can be helpful to secure the system by following their guidelines.

  1. Single Sign-On

The SAP single sign-on function enables you to configure same user credentials to access multiple SAP systems. It helps to reduce administrative costs and security risk associated with maintaining multiple user credentials. It ensures confidentiality through encryption during data transmission.

  1. AIS(Audit Information System)

AIS or Audit Information System is an auditing tool that you can use to analyze security aspects of your SAP system in detail. AIS is designed for business audits and systems audits. AI presents its information in the Audit InfoStructure.

SAP technology has changed radically in recent years, and this has had a direct impact on SAP security. This is what drives SAP cyber security. It is no longer sufficient to enforce strong passwords and enable audit logs in the SAP system.

While implementing SAP GRC helps, ability to manage Segregation of Duties (‘SoD’) is not going to help if someone can compromise SAP user accounts and escalate their privileges. SoD will also not help if an intruder can simply bypass SAP authentication and authorisation controls.

SAP systems consist of many components such as the NetWeaver Application Server (ABAP and Java versions), SAP gateway and messenger server, RFC gateway, Internet Communications Manager (‘ICM’), SAProuter, and more. The systems use many different communications protocols such as DIAG, Remote Function Call (‘RFC’), and HTTP. They often has a large number of interfaces – mostly using RFC. Many of these have stored logon credentials, which are unencrypted and lack basic security controls.

SAP landscapes also tend to be complex with a large number of systems and clients and users often end up reusing their passwords across these systems. Get hold of one of them, and you have it all. Even when Single Sign On (‘SSO’) is enabled, password logon is allowed, leaving the backdoor open for the intruders. A simple scenario will be for an intruder to get the password hash file from a less secure SAP development system, crack the password (if password is backward compatible) and then use the same credentials to logon to SAP production system.

But hold on, isn’t there a Security Operations Centre (‘SOC’) monitoring all my IT systems for security breaches? Well, more often than not, SAP application level security logs are not integrated with the SOC. An organisations’ SIEM solution is often not configured to monitor SAP logs – probably because they are managed in a Silo by a SAP team within the larger IT team.

And if this is not enough, all SAP systems have a large amount of custom developments, reports and transactions, which are written by SAP programmers who do not have to follow any secure coding requirements. This is because most organisations don’t have one for SAP codes! It is highly likely that these custom developments are never tested for security vulnerabilities. This, despite the fact that simple ABAP-injection may be used to take over the entire SAP system or a directory traversal vulnerability, may be used to shut down the entire system.

Organisations often fail to realise that as the number of known SAP security vulnerabilities have increased manifold. The attack surface for SAP vulnerabilities has also increased with the adoption of newer technologies, and managing complex hybrid SAP environments consisting of on-prem and cloud solutions is becoming more and more complex. The rewards for comprising the ‘crown-jewel of the IT landscape’ continues to be highly tempting. So, it is not surprising that SAP has received more (unwanted) attention from hackers during this decade than probably its entire lifespan.