Strengthening SAP Security with Access Control Lists (ACL)

Organizations face the ongoing challenge of securing their valuable assets, such as financial data, intellectual property, and customer information, stored in SAP systems. Unauthorized access to these assets can lead to severe consequences, including financial loss, reputational damage, and legal ramifications. Traditional security measures, such as firewalls, can effectively protect the network perimeter, but they often fall short in securing internal systems and data repositories, like SAP systems.  

Why? We name two main reasons:  

1. There are multiple threats / exploits that simply cannot be stopped at the network level alone but require application-specific settings. 
2. Complex architecture and several components in an SAP system require network connectivity.

To elaborate on this last point, SAP systems have a multi-layer architecture; their components are highly scalable and can be distributed among several hardware resources to facilitate even the highest landscape requirements. This offers excellent flexibility but comes with the price of significant complexity as well! The number of components involved in connectivity is vast, and even with relatively small SAP landscapes, oversight is easily lost. Let’s take a typical SAP ABAP system as an example. From a technical connectivity standpoint, there is connectivity from user interaction, coming from browsers, apps, and (the everlasting) SAP GUI. There is system integration for interfacing and other technical components like LDAP, file shares, email connectivity, monitoring agents, databases, etc. That is all aside from the elements of the SAP system that need various connections to operate, whose complexity significantly increases for more significant landscapes and higher available setups. Look at this overview of TCP/IP ports for SAP products; managing and controlling connectivity in an SAP landscape is no small feat…  

So, can this all be managed securely by relying on network components alone? Is a firewall enough? The answer is simple: no, it is not. Firewalls primarily focus on traffic filtering, packet inspection, and network segmentation. These are essential security features, no doubt about that. However, they do not offer the granular form of application security that is required nowadays. In fact, without additional application security, SAP systems are highly vulnerable to known exploits, which can come from external as well as internal sources.  

As said, advanced application security is paramount to safeguarding SAP systems. In this blog, we only look at technical connectivity and want to point out the added value that Access Control Lists have for SAP security. It is a great addition to network measures like firewalls and different network zones because it allows for a more granular distinction that can be controlled from the SAP application level. SAP is offering ACL functionality for multiple components, like the following: 

• Message server: central component used in SAP ABAP and Java stacks.  
• Internet Communication Manager (ICM): mainly used for HTTP(S) and SMTP protocols (but there is a lot more). Note that the Web Dispatcher can be set up similarly. 
• RFC gateway: for RFC communication between SAP systems and external programs. 

The above list is incomplete, and each named component has its specifics for the configuration of an ACL which would deserve a separate blog. In principle, though, an ACL is a rule set that either ‘permits’ or ‘denies’ a certain type of connection related to the component. Like the example of a message server ACL (see link below).