CONTACT US
Search
CONTACT US
SAP ABAP Code Quality Benchmark

SAP ABAP Code Quality Benchmark

/in /by
Download eBook

SAP code, mostly written in the ABAP programming language, is an integral part of securing SAP systems. Complexities in the system make it difficult to ensure the code meets requirements. This e-book highlights just how common code issues are and their negative impact on security, compliance, performance and stability. 

Download the e-book to review key findings from Onapsis research, including how many lines of custom code an average SAP system has and how many of those may contain critical security and compliance issues!
 

Onapsis Webinar

SAP Security: 5 Challenges of the CIO

/in /by

Managing Up Means Understanding The Role of Your CIO

ON DEMAND

The Chief Information Officer (CIO) holds responsibility for all IT decisions affecting the company, a task that has increased in complexity since the early days of the internet. A strong company needs a developed IT strategy to remain connected and competitive. The complexity of these IT projects, including digital transformation, is higher than ever.

Onapsis Webinar

Protiviti: Transform Your Business With Confidence by Tackling Your Cyber Risks Using Onapsis

/in /by

Transformation-Proof Your SAP Applications with Onapsis and Protiviti

ON DEMAND

Growing demand for intelligent, available, and accurate data is fueling organizations to carry out digital transformation activities. SAP transformations, such as S/4HANA migration, are key drivers for growth, but also create and expose organizations to significant risk. To properly manage risk before, during, and post transformation, organizations should have defined cybersecurity programs to ensure proper protection of critical business data.

This joint session with Protiviti will lay the foundation for proper cyber program activities and detail how the Onapsis platform provides the required capabilities to defend against risk and drive growth during transformations. We will explore the current threat landscape for SAP tools, such as known SAP vulnerabilities, and discuss their associated business impacts. The Onapsis platform mitigates risk through automated assessments, continuous monitoring, and ongoing governance.

A live demo of key Onapsis capabilities will be performed to demonstrate how vulnerabilities, such as ABAP or HANA code, can be eliminated with tools such as their CodeProfiler.

Cybersecurity programs need not be an afterthought. Ensure your organization is properly preparing for digital transformation with strategic risk activities.

Onapsis Webinar

How to protect your SAP landscape against hackers

/in /by

Understanding the Biggest Threats from External Attackers

ON DEMAND

Are you aware that common misconfigurations in SAP may allow an attacker to compromise your SAP system in less than 60 seconds? Did you know that public exploits for business-critical applications have increased 100% since 2015?

Attend this session to:

  • See how an attacker can infiltrate your SAP system by abusing well-known misconfigurations
  • Understand the most common attack vectors towards your SAP landscape
  • Learn how you can protect yourself by using SAP security automation and alerting

Onapsis Webinar

SAP Transport Security: Transformation with Less Risk and More Efficiency

/in /by

Learn how to reduce the risk introduced through ongoing changes in your Software Development Life Cycle

ON DEMAND

There’s a good chance you are either planning or in the midst of a significant digital change project (or several?). Any change to your SAP Landscape might introduce security vulnerabilities, putting your entire IT infrastructure at risk.
 
In this session, we’ll look at the common types of changes happening in your SAP landscape and how those might introduce security vulnerabilities that can roadblock productivity. We will also highlight reasons why this threat vector is a growing target for attackers.
 
We’ll also explain the cost it creates for organizations to address those potential security issues manually today and see how Onapsis can help to automate many of the manual change review steps to speed up release cycles, reduce cost and reduce the risk of an impact from a critical security vulnerability.

Canadian Media Corporate Builds Code Analysis and Compliance Checks Into Development Process, Accelerate Application Delivery and Passes PCI DSS Audit

/in /by
Industry – Media Production
Company Size – 1000+ employees

Background

One of Canada’s largest media organizations has evolved into a full service multimedia publishing across four major platforms: print, online, mobile and video. Handling high volumes of credit card transactions and credit card data is daily business; therefore PCI DSS compliance is a must for the organization.

The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that store, process or transmit cardholder data. Introduced in 2004 by five major card companies (Visa, Master Card, American Express, Discover and JCB), the primary goal of the standard is to protect cardholder data and to reduce data theft and credit card fraud. 

Failure to comply with the standard can result in substantial penalties, restrictions or even barring. Payment Card Industry Security Standards Council, for example, has established fines of up $500,000 per incident for security breaches at non-compliant organizations. 

One of the major requirements regarding PCI DSS compliance is to develop and maintain secure systems and applications. After an initial assessment, the media corporation decided to bring all card data into their SAP systems and encrypt it. A lot of work went into moving credit card data from a multitude of less secure databases and files into SAP. Now that SAP was storing cardholder data, it needed to meet PCI DSS standards. 

The organization has used SAP solutions since 2002. In order to adapt its SAP solutions to specific requirements of the North American market, they had to put a lot of ABAP custom development into its SAP systems, with most of the major developments done by external companies.

Challenge

Improve custom ABAP code to meet PCI DSS requirements and pass external audit on SAP systems

Solution

Onapsis scans all ABAP code for vulnerabilities or misconfigurations against PCI DSS requirements so developers know exactly what to fix. The media corporation can produce reports from Onapsis and share these with external auditors to prove their code meets compliance. The time and resources needed to make their code compliant and prove that compliance has been significantly reduced, allowing internal teams to focus on development and accelerate application delivery

  1. Fast reliable and automated identification of code issues
  2. Tight integration into SAP change management processes
  3. Accelerate application delivery
  4. Easily produce documentation and third-party audits
  5. Ensure PCI CSS compliance at code levels

Solution

With Onapsis code analysis, the organization was able to scan their ABAP code to see if it complied with PCI DSS. Onapsis testing is comprehensive and tightly integrated with SAP and can be customized to test code specifically against PCI DSS requirements. This way developers know exactly what to fix. 

Using Onapsis also enabled the media corporation to easily produce reports and documentation that they could share with external auditors regarding the current state of their code, which significantly reduced the time and resources needed for the audit process. After a couple rounds of testing and fixing, the organization was able to use these reports to prove to auditors that their ABAP code was compliant with PCI DSS. By building Onapsis code analysis into their development process, they can now ensure these compliance baselines are implemented from the start and all new code will be compliant.

Results

  • Ensure PCI DSS compliance at code level
  • Fast, reliable and automated identification of security and compliance risks in SAP’s ABAP custom code
  • Tight integration into SAP change and transport management processes with enforced ABAP code auditing (“ABAP Code Firewall”)
  • Easily produce documentation for third party audits, freeing up development resources to focus on core competencies instead of audit preparation
  • Accelerate application delivery by building compliance checks early in the development process and providing actionable remediation guidance

Large utility company builds SAP vulnerability management program, reduces remediation time by 80%

/in /by
Industry – Utilities, Gas and Electic 
Company Size – 2k+ employees, >$2B revenue

Challenge

Unaddressed risk in critical SAP applications due to complex patching process and no visibility into other vulnerabilities

A large American utility company relies on SAP applications for many of their business-critical processes. Despite their critical nature, however, the company lacked visibility into the security posture of these applications- what vulnerabilities existed and what risk they posed to the business. Their patching process was complicated and time-consuming, and their existing vulnerability management tools didn’t sufficiently support SAP. The organization realized they had unaddressed risk within their critical systems, but they had no way to measure, understand, and act on it. With a major SAP S/4HANA migration project planned, they knew they needed a solution that could address this risk in the short-term and be used throughout the transformation.

“Onapsis removes the mystery around SAP security by increasing visibility. We can see issues — misconfigurations,missing patches or overly privileged users — what risk they pose and how to fix them.”

Enterprise Security Manager, Utility Company

Solution

Onapsis time-saving vulnerability scans provide deep visibility, detailed solutions, and business impact to identify risk and accelerate response

The utility company found their ideal solution with Onapsis Assess, which uniquely provides focused and comprehensive vulnerability management designed for SAP applications. Automated assessments, detailed solutions, and descriptions of business impact enable the organization to easily identify the true risk to their critical application landscape and understand how to respond. Onapsis Assess also significantly improved their patching processes, eliminating much of the manual work that was previously required. The included context from the Onapsis Research Labs helps them quickly determine which SAP Security Notes to prioritize, the best way to implement, and if they are missing any critical patches.

“With Onapsis, we were able to establish and maintain SAP security baselines and can now build them into transformation projects from the start. Onapsis enables us to keep SAP secure without impacting system performance or interfering with Basis teams.”

Enterprise Security Manager, Utility Company

Results

60% less time spent investigating issues and 80% reduction in mean time to remediate (MTTR) thanks to research-driven analysis provided by Onapsis
  • 80% Reduction in Mean Time to Remediation (MTTR)
  • 90% Less time spent on patching
  • 60% Reduction in investigation time

The deep visibility and research-driven results provided by Onapsis Assess give the utility company an accurate understanding of risk within their critical systems and the context they need to quickly act on it. The detailed explanations and business impact provided by Onapsis mean the company’s security teams don’t have to be SAP experts themselves; they can make informed decisions on how to respond without having to spend a lot of time investigating each issue. Integrating Onapsis Assess with their ServiceNow further facilitates remediation efforts by aligning their security teams using Onapsis with their Basis teams responsible for fixing the issues. Leveraging this workflow and arming the Basis teams with Onapsis-provided step-by-step fixes has helped reduce the company’s mean time to remediate (MTTR) by eighty percent. 

The utility company has also leveraged the customizability of Onapsis Assess to establish their own security baseline. By creating a custom scan catered to their business priorities and risk profile, they can regularly assess against it to ensure their systems continue to meet their security standards. They will use this baseline throughout their upcoming SAP S/4HANA migration to ensure their new systems are being configured securely.

Multinational Food Manufacturing Company Case Study

/in /by
Industry – Food Production
Company Size – 160k+ employees, >$115B revenue

Challenge

As one of the world’s largest food production and shipping companies, with involvement in agriculture, animal nutrition and protein, food and financial and industrial processes, this 150-year-old multinational organization with locations in 70 countries operates at a scale and reach unlike many others. This operational footprint presents them with significant challenges and opportunities from an SAP perspective. They have 400 SAP applications spanning 40 products and 25,000 users, and undertake nearly 400 active projects per month. Given this magnitude and the critical nature of these systems, the organization needed a solution that would help them identify, understand and mitigate security risks across their entire landscape. With security baselines established, they needed a way to measure and operationalize them across new and existing application use cases, including new business ventures, partnerships and growth projects from the start. 

As well as SAP security and meeting internal baselines, the organization needed support in terms of regulatory compliance, responding to and demonstrating adherence with legislation such as GDPR and CCPA. Maintaining both their security and compliance posture, despite the significant volume of change involved with managing an SAP system of this scale, was essential for achieving their ultimate goal of cyber resiliency for their business-critical applications.

  1. Understand business risk due to system vulnerabilities
  2. Streamline the SAP patching process
  3. Prevented unauthorized changes and misuse, supporting application stability
  4. Integrated directly with SIEM to monitor for SAP threats 
  5. Ensured compliance with internal and industry policies

“Most security professionals can’t spell SAP, yet 77% of global GDP passes through SAP systems. This establishes them as critical systems, but the lack of knowledge around the systems means they are often overlooked. The further up the stack you go, the more specialized this knowledge becomes. There are very few SAP security specialists that look at specific applications and how they pose a threat this is what makes Onapsis such a valuable partner for us.”

Solution

Onapsis’s pedigree in both security and compliance for SAP positioned them as the perfect solution for the food production company. The success comes from a relationship based on a partnership, instead one between customer and provider, with each side understanding the role they play. Onapsis provides the actionable insight and continuous monitoring the organization needs to understand security and compliance risk within their SAP environments, but it is ultimately up to the organization to prioritize and respond to these risks given their risk posture and tolerance. Likewise, if the organization needs additional information or support, Onapsis provides the expertise they need to act and protect their applications. By partnering with Onapsis, the organization keeps their global SAP stable, protected and compliant with security baselines. They are able to: 

  • Gain visibility to make informed decisions about levels of acceptable residual risk 
  • Discover and understand business risk due to system vulnerabilities, missing patches and misconfigurations, which helps to frame conversations around risk with internal business partners 
  • Simplify compliance and demonstrate they are in line with internal security baselines and industry regulations 
  • Streamline the patching process and understand how to prioritize missing SAP notes 
  • Continuously monitor their system health, which helps to maintain application availability and stability, and identify and prevent unauthorized changes, misuse or cyberattacks 
  • Integrate directly with their SIEM with custom alarms to inform SOC of potential exploits or threats to SAP systems &  applications 
  • In the future, manage change via code and transport analysis to accelerate development, avoid downtime or errors and minimize manual reviews

Sitemap  | Terms of Use | Privacy Policy   |  Quality Policy  |  Disclosure Policy |  Security Vulnerability Reporting Guidelines |  ©2025 Onapsis  |  All rights reserved