SAP Security & Compliance: Challenges in the Context of S/4HANA, Code Security, and the Cloud

SAST DAYSThey say that major events cast a shadow that portends their arrival. In SAP environments, this applies in particular to the transition to S/4HANA, which companies will need to make before maintenance for SAP ERP expires in 2025.

As we covered this pending migration from various perspectives at our SAST DAYS 2019 event, interest in the topics of authorizations and code security was especially high. Let’s take a look back at those exciting days, which presented a balanced mix of current challenges and assorted solutions.

Continue reading

The State of SAP Security 2018: Between platform security, authorization management and S/4 HANA migration

SAST_HANA_S4HIt’s probably too early to sum up the state of SAP security in 2018. Then again, fall is the season for events such as the DSAG Annual Congress (German SAP User Group), which just ended in Leipzig. It is at conferences and trade fairs like this that you get a chance to find out exactly what is on the minds of SAP customers. As a result, it isn’t too soon to get a reading of the security issues that are considered important in the SAP environment.

Continue reading

Are you really that attached to your ABAP security flaws, or is it time to say goodbye?

SAST Code Security AdvisorAlmost all companies fine-tune their SAP systems with custom developments, but in doing so, they often expose themselves to severe security flaws. In particular, forgotten code that was only needed for a short time or has since been rendered obsolete by SAP’s own enhancements presents a further avenue for attacks.

AKQUINET’s analyses show that up to 90% of ABAP code is no longer used. Frequently written for one-time situations and neglected ever since, such programming offers an ideal back door for hacking and other forms of manipulation.

Continue reading

WITH HEADER LINE – it’s not simply obsolete; it’s a risk.

shutterstock_424352977_akqw_jpgThe addition “WITH HEADER LINE” has technically been unnecessary going back several SAP versions now. This is because the statement declares both internal tables and an additional data object – the header line.

There are a large number of notes that spread awareness that the use of this statement causes various content problems. Among other things, the use of the same name means that it is not immediately apparent as to whether you are working on a table or a header line.

However, what the notes typically do not warn you about is that this kind of programming goes hand in hand with security problems for your SAP systems.

Continue reading