Strengthening SAP Security with Access Control Lists (ACL) -
Managing access control from the application layer

Organizations face the ongoing challenge of securing their valuable assets, such as financial data, intellectual property, and customer information, stored in SAP systems. Unauthorized access to these assets can lead to severe consequences, including financial loss, reputational damage, and legal ramifications. Traditional security measures, such as firewalls, can effectively protect the network perimeter, but they often fall short in securing internal systems and data repositories, like SAP systems.  

Why? We name two main reasons:  

1. There are multiple threats / exploits that simply cannot be stopped at the network level alone but require application-specific settings. 
2. Complex architecture and several components in an SAP system require network connectivity.

To elaborate on this last point, SAP systems have a multi-layer architecture; their components are highly scalable and can be distributed among several hardware resources to facilitate even the highest landscape requirements. This offers excellent flexibility but comes with the price of significant complexity as well! The number of components involved in connectivity is vast, and even with relatively small SAP landscapes, oversight is easily lost. Let’s take a typical SAP ABAP system as an example. From a technical connectivity standpoint, there is connectivity from user interaction, coming from browsers, apps, and (the everlasting) SAP GUI. There is system integration for interfacing and other technical components like LDAP, file shares, email connectivity, monitoring agents, databases, etc. That is all aside from the elements of the SAP system that need various connections to operate, whose complexity significantly increases for more significant landscapes and higher available setups. Look at this overview of TCP/IP ports for SAP products; managing and controlling connectivity in an SAP landscape is no small feat…  

So, can this all be managed securely by relying on network components alone? Is a firewall enough? The answer is simple: no, it is not. Firewalls primarily focus on traffic filtering, packet inspection, and network segmentation. These are essential security features, no doubt about that. However, they do not offer the granular form of application security that is required nowadays. In fact, without additional application security, SAP systems are highly vulnerable to known exploits, which can come from external as well as internal sources.