SAP Security Testing: Tools, Techniques, and Best Practices

Expanding the Scope: Key Focus Area of SAP Security Testing 

Before we look at the newer technologies, let’s focus on the core “legacy technology of NetWeaver AS ABAP systems (which now also includes S/4HANA and BW/4HANA systems). What else should we be testing in these “ABAP-based Environments? This question expands our scope of testing from traditional #SAPSecurity testing to #SAPCyberSecurity Testing! 

What is included in the expanded scope?  We must include: 

• Basis configuration Testing 

• Penetration Testing 

• Security and Compliance Testing (scheduled scans) 

• ABAP Code Testing 

 

Strengthening Security Between Penetration Testing Cycles 

Having Penetration Testing a full-time, ongoing business function at your company might seem unreasonable — and that’s fair.  So, what can you do to help in this area of testing when your company is “in-between” active PenTest contracts?  

• Remember, hackers don’t operate under the same ethical and contractual constraints as your PenTest Vendor.  They test your defenses on their schedule, not yours! 

• Review your Penetration Test schedule frequency.  Instead of conducting tests once a year or every three years, consider increasing the frequency to every six- or nine-month intervals for better security coverage. 

• Consider setting up a full-time “Red Team”, even if it’s a small one. 

• Use an automated third-party “Blue Team” solution to strengthen your #SAPCyberSecurity defense posture.  My recommendation, of course, is the SecurityBridge Platform. 

• Consider chartering a Purple Team program. This program not only oversees the independent events of the Red Team but also ensures that their findings are implemented as defenses by the Blue Team. This war-gaming approach will significantly reduce your attack risk from external threat actors. 

 

Examples of Basis Configuration and Parameters in SAP Security 

Here are some example Basis Parameters and Configurations that should be in scope for SAP Security Testing. 

• Check the status of all Basis Parameters across your SAP systems 

• Verify system profile parameters for the Message Server 

• Verify RFC Gateway by inspecting Access Control Lists (ACL) files, settings, profile and data dictionary 

• Verify Transport Control Security by inspecting system profile parameters and the user master. 

• Check for existence of Obsolete Clients 

• With the SecurityBridge Security & Compliance Monitor, hundreds of checks can be executed across your SAP environments by utilizing scheduled jobs 

 

Examples of Testing Traditional SAP Security Sensitive Users 

SAP Critical Users can be tested for multiple vulnerability scenarios based on their ability to perform critical functions.  Additionally, it is important to verify that Security Logging is active and properly configured.  Here are just a couple of examples: 

• Status of the SAP Security Audit Log – Is it enabled, turned off, or over-filtered?  If disabled, the system will have a very limited dataset for forensics and threat monitoring. 

• Critical User Attributes – Ensure that passwords, user groups, validity periods, and user types are properly assigned and configured. 

• Users with Critical Authorizations – Debug, password change/reset, delete SAP SID Clients, Program Start/Execute Programs, RFC Calls, and more.  

• To test the hundreds of checks and use cases, use SecurityBridge Security & Compliance Monitor to set up scheduled scans of your targeted systems. 

 

Examples of ABAP Code Security Testing  

ABAP Developer teams that run a classic “DevOps” model can enhance their security posture by evolving into Secure Development Operations (#SecDevOps or #DevSecOps). 

SAP provides all ABAP Dev Teams with the ABAP Test Cockpit (ATC).  SecurityBridge allows these dev teams to infuse additional test cases specifically focused on SAP Security.  SAP Security testing should include these ABAP Code Vulnerability Types:   

• SQL Injections 

• Directory Traversal 

• Authority Check validation  

• Mass Data Change/Delete 

• Many more… Use the SecurityBridge Code Vulnerability Analyzer to automate these tests on a scheduled basis 

 

What Other Testing Topics Should Be Considered?  

Pull it forward! (aka “Shift Left”)  

SAP Security and Testing should be a part of your SAP Program and Project Charters.  SAP Security Testing needs to be in scope early to drive personnel and budgeting decisions — don’t make it an “afterthought”.  Crisis planning can result in pushing entire workstreams out of scope or delaying the Project Go Live Date. 

“Embedding” an SAP Security Consultant Workstreams 

When populating your Business Process and Technical Workstreams make sure to “embed” a competent SAP Security Consultant in the workstream. 

You might think that this “Security Embed” is an additional overhead that would slow down the workstream in the short term. However, in the long term, this one strategic move ensures that your workstream can successfully enter and exit key project phases such as Integration Testing and Cutover Testing.   

(Hint: You need to use the actual Post-Go-Live Roles and Permissions in those phases — not an over-privileged Testing Role!) 

Key Questions to Consider  

• How does that role get created or modified? 

• How does it get tested?   

• Is Role testing in scope for your workstream? 

In your Transformation workstreams, your workstream leads are “in the trenches” working on delivering the solution for their represented business process.  However (speaking from lived experience), are those workstreams thinking about Security Testing from the beginning?  Are they thinking about Security Testing when they are creating their SDLC/RICEFW Documents? 

Baseline and Status-Check Your SAP Cybersecurity Risk Posture 

Use SecurityBridge to baseline and status check your SAP CyberSecurity Risk Posture before, during, and after your SAP Projects. 

Positive and Negative Testing 

When building your Test Cases and Test Sets, remember to incorporate both “Positive Testing” and “Negative Testing”.  This helps to ensure that your users receive exactly and only (Least Privilege) the permissions needed to fulfill the specified business function. 

 

Wrapping Up: A Reference Guide for SAP Security Testing 

This blog is packed with a lot of ideas, so please use it as a reference tool.  Feel free to revisit it after taking some time to digest these concepts.   

We never really got beyond the legacy ABAP environments, but by extension, that also includes SAP S/4HANA and SAP BW/4HANA. We can focus on SAP Security Testing in newer technologies in the next blog post. 

As always, feel free to reach out.  I am active on LinkedIn and happy to engage with you there.