Businesses of all sizes and in all industries use SAP software, and it has become an indispensable part of day-to-day business. SAP system landscapes are often the heart of a company, as they process highly sensitive data and business-critical information. A successful hacker attack against this environment can thus have very serious consequences for the company. A SAP pentest can help you to protect your systems and applications from attacks.

What is a SAP Pentest and Why is It Useful?

During a pentest, security analysts take on the role of a malicious hacker. They use methods, techniques and procedures that a real attacker would use. The objective is to identify vulnerabilities and entry points in order to correct them in time before a real attacker can exploit them. SAP system landscapes are often quite complex in structure and consist of a large number of specific SAP products. Our experience shows that in-depth expertise and a profound understanding of SAP products are necessary to comprehensively analyze the security status of SAP environments. A "traditional" pentest at system- or application level is not sufficent. In fact, a special approach is required that includes SAP-specific test elements as well as differentiating between the examination of web-based FIORI applications and SAP products at the system level

What are Common Vulnerabilities in SAP Environments?

SAP environments can have a wide range of different vulnerabilities due to their complexity and individuality. Following are some of the most common vulnerabilities that our security analysts identify when conducting SAP pentests:

• Misconfigurations of SAP's own RFC protocol allow attackers to access sensitive data and perform far-reaching actions.
• In some cases, highly critical security vulnerabilities in the self-programmed ABAP report, which allow the attacker to extend rights or even completely compromise the system.
• Misconfiguration of settings and system parameters can lead to inadequately encrypted or even non-encrypted communication. This allows attackers to intercept and read communications and sensitive data.
• Insufficient demarcation between development, test and production systems causes insufficient protection of the systems and thus makes them more vulnerable to attacks. An attacker can thus access productive data and a logged-in user can escalate his or her rights.

How Can We Help?

Our security analysts have developed a special approach for conducting SAP pentests. In preparation for the pentest, we closely coordinate with you on the scope of your test, the attack scenario, as well as the procedure and execution. The results of our security analysis are documented in a comprehensive report, including recommendations for the elimination of identified vulnerabilities. If you wish, we can support you with our Vulnerability Management Services to help you achieve a good overview of your security situation, identify vulnerabilities as early as possible and deal with them in a structured manner.

Would you like to analyze your SAP infrastructure for entry points? Here you can find more information about our approach and the optional ABAP Quick Check. Please feel free to contact us.