SAP Platform Security – The Last Line of Defense

In today’s IT landscape, security plays a crucial role in minimizing risks for business. Companies invest heavily in defensive measures to keep malicious parties outside their corporate networks. Typical security investments in the SAP regard areas like:  

• Network security (Firewalls, IDS / IPS, Web Application Firewalls, etc)  
• Operating System and Database security  
• Endpoint and Interface Security  
• SAP Authorizations and GRC 

All the above technologies are deployed to defend against malicious attacks, and while they certainly have their value, we still see daily headlines of organizations worldwide getting breached. This is not surprising, as there are numerous ways for malicious actors to gain access to corporate networks, like:  

• Technical vulnerabilities in software (SAP alone released close to 200 SAP Security patches in the past 12 months)  
• Phishing or other social engineering attacks against your employees  
• Using stolen accounts, Credential theft… 

Once an attacker has gained access to the corporate network, there is often not much standing in the way of these business-critical SAP environments. SAP systems typically contain organizations’ crown jewels, like sensitive customer data, intellectual property, or financial data. 

Traditional generic security solutions do not work on the SAP application layer, while SAP authorizations and GRC solutions only minimize risks once a malicious actor is already inside the SAP application.