Why you should automate SAP Security
With over 355.000 customers in 180 countries, SAP software facilitates business in many ways.
Since SAP’s inception in 1972, its software has undergone several radical transformations, from:
- mainframe application to client-server
- monolithic application to a set of software layers based on NetWeaver
- local codepages to Unicode
- intranet to internet-enabled
- on-premise to cloud
At the same time support for different operating systems and databases has grown.
This has resulted in major application changes:
Evolution of SAP systems
Technically, this is how a SAP system from 1992 differs from a current one:
Complexity and security
Despite these advances in SAP technical infrastructure, a similar massive evolution in security technology never happened. Many SAP customers still take no special security measures and rely completely on the built-in security features of SAP. This “strategy”, (or rather: lack of one), could prove costly in the long term as the cybercrime industry continues to evolve and develop.
Higher complexity means many more hiding places for vulnerabilities
Due to the complexity and uniqueness of SAP system landscapes in terms of software versions, components, system types and operating systems and database types, it has become impossible to check a SAP landscape manually. Manual security checks are time-consuming (and therefore expensive), tedious (and therefore fault-prone) and often incomplete because checklists tend to be universal and they are seldom revised and updated.
Protect4S has a repository containing more than 1250 checks which could be executed as frequently as desired on every application server and within every client belonging to a SAP system.
Common vulnerabilities
Although SAP delivers a loosely coupled set of security tools in the Solution Manager system and offers various more expensive and specialised solutions like GRC and Fraud management, most SAP customers still struggle to close the basic security gaps that enable the exploitation of their systems.
As a company that specialises in SAP security, the common vulnerabilities that we see in practice are:
Protect4S covers all the vulnerabilities listed (and many more) and detects them in your SAP systems. After detection, we show you the way to get rid of them in a cost-effective manner.
SAP Security Notes
New vulnerabilities are discovered every day and SAP brings out patches monthly. And yet, most SAP customers do not actively implement these SAP security notes.
This is mainly because customers are not able to determine which notes to implement, since the configuration of this functionality inside the SAP Solution manager is not straightforward and the functionality it offers is not without bugs and false flags.
Protect4S is unique in the sense that it accurately lists the missing security notes in SAP systems, no matter whether you run ERP, SCM, CRM, PI or a Portal system.
Stay in control
Try our SAP Solution Manager Addon Protect4S for a year and discover for yourself how Protect4S helps you to stay in control of the risks from vulnerabilities inside your SAP infrastructure.
For more SAP security-related news, articles, and whitepapers, please follow us on LinkedIn and our YouTube channel!
