Close

HAVE QUESTIONS?

A partner account manager can help. Contact us today.

Subscribe me to your mailing list

Tweet

SAP BASIS

Problem

One of the main problems of SAP security is the complexity of the system. Time management is a critical task, especially because of the inconsistency in documentation which is sometimes scarce, sometimes copious. The complexity is further amplified when new found SAP vulnerabilities are generally rectified by installing additional options that come with their own set of parameters. This alters relations between settings, creates lengthy manuals for specialists to interpret if they need to rectify a system. On top of that, an average SAP system is 50 % customizable, which creates even more problems on top of typical configurations. With the standard system configuration that spans over 7000 security-related options, an array of advanced configurations along with critical access rights for various objects like transactions, tables, RFC procedures, etc. and a hundred other web interfaces for system access, it's a workload to bear.

With the enormous line-up of configuration jobs and dozens of servers required for a typical infrastructure, ensuring security could take a long time. Even if initial hiccups are taken care of, additional source code security risks and customized programs developed by third party developers need to be shielded and controlled from backdoors and errors.

Lastly, it is about Segregation of Duties and access control since SAP departments spend time on analyzing risks related to access control.

Solution

ERPScan can significantly simplify tasks by constantly cataloguing systems, storing system configuration data in specific places along with continual monitoring of every area related to security, vulnerabilities, configuration, access control, and Segregation of Duties for every available system.

Advantages:

  • Automate routine by identifying 7500+ misconfigurations and 3000+ vulnerabilities across all types of SAP platforms (ABAP, JAVA, HANA, BOBJ, Mobile), Systems and Industry solutions;
  • Manage risks, assign tasks, compare results, and analyze trends by using dashboards;
  • Employ SAP experts and leading SAP SE partners in security areas. This allows understanding found problems more easily along with their solutions, even for users inexperienced in SAP;
  • Comply with SAP specific guidelines such as DSAG, ISACA, EAS-SEC, SAP Security Guidelines as well as industry-specific guidelines;
  • Monitor specific applications like SAP XI/PI, SAP Solution Manager, SAP SDM as well as industry solutions;
  • Analyze unlimited critical combinations of authorizations and transactions. As compared to SUIM transactions, our own search engines are easy to use and highly advanced, making it possible to identify users with critical access. Pre-configured templates with critical assess are available for different modules and industries;
  • Deeply analyse 3000 SAP Security Notes using unique combination of whitebox and blackbox checks and their priorities for a complete focus on the ones that are important, thereby decreasing downtime during updates;
  • Keep a check on your development team by analyzing source code of ABAP and JAVA applications against program vulnerabilities and backdoors;
  • Improve SoD.