[ Cyber Security Continuity of SAP Operations Compliance ] C-Forge 2017

Transcription

1 [ Cyber Security Continuity of SAP Operations Compliance ] C-Forge 2017 Virtual Forge Security and Quality Suite

2 Road to Green the Successful Approach for Protecting SAP Landscapes Assess: Our tool-supported approach for Risk Assessments and SAP Penetration Tests will deliver a detailed insight into the state of your SAP security and quality. Stay Clean: Virtual Forge Solutions build a strong firewall to validate all SAP changes for any security and quality related risks. Our continuous monitoring and built-in reporting functionalities ensure a clean and secure SAP system landscape. Get Clean: Our services and solutions will help you harden your SAP systems for a fixed price in a fixed time.

3 How Security & Quality issues arise

4 Virtual Forge Quality and Security Suite

5 Virtual Forge Quality and Security Suite

6 SAP Change Control: TransportProfiler

7 What TransportProfiler can do for You Transports need to be imported to be analyzed properly. Additional cost and effort is required. For you this means: TransportProfiler will save time, costs and effort by analyzing transports before importing. Transports often contain dangerous content. System stability is at risk and changes to business data lead to compliance and security issues. For you this means: TransportProfiler protects systems against downtime, critical content is identified early.

8 Control your SAP Transports TRANSPORTPROFILER Change Control Security Compliance Quality Virtual Forge TransportProfiler checks transport objects for completeness, consistency, and changes in critical data. This makes it possible to identify flawed transports in advance, which in turn helps to avoid security issues, damage to target systems, and the costs and effort required for correcting errors.

9 Virtual Forge TransportProfiler for You this means: Proactive Approach Transport Profiling before release to target system Correction possible before incident occurs Protection from system downtime and blockages No systems blocked by transports Critical changes will be detected in time Secure transport management Transports will be validated before import Protection from Malware and security weaknesses in transports Significant cost savings Reduces the need for additional systems Reduced effort for transport validation

10 Virtual Forge TransportProfiler General Features Cockpit Support for various transport request inspection scenarios Validation of Exports or Imports into a Target System Validation of external transport files / 3rd-Party Products Software Delivery Validation Transport requests can be validated for completeness before delivery Finding Manager Detailed information and description for all findings Audit proof documentation (PDF) Transport Organizer Integration Customer Test Cases

11 TransportProfiler: Control Your SAP Transports DEV QA PROD SAP Scan in Check the cloud critical objects TransportProfiler TransportProfiler TransportProfiler Check consistency Transports Local RFC Extern Check completeness Analysis & Reporting 100% integration Sandbox Copy of production

12 System Check: SystemProfiler

13 What SystemProfiler can do for You 95% of all customized SAP systems are vulnerable. An attacker can gain full access by exploiting just one of these vulnerabilities. For you this means: SystemProfiler will secure the entire SAP system landscape and continuously monitor for potential vulnerabilities. Keeping up with changing environments is cumbersome, configuration drift is a constant challenge. Keeping up involves tremendous costs and effort. For you this means: SystemProfiler will help SAP adminstrators to focus on their core tasks. Manually checking for configuration errors becomes a thing of the past.

14 Secure your SAP System landscape SYSTEMPROFILER SAP NetWeaver for ABAP. Java and SAP HANA Security Compliance Virtual Forge SystemProfiler is an unique solution for validating and securing SAP system configuration and base authorizations - to detect and correct errors, and to avoid recurrence. This leads to minimized critical risks, significant cost reduction through more stable, and faster SAP systems and drastically reduced effort for monitoring and correction measures. Quality

15 Virtual Forge SystemProfiler for you this means: Security and compliance risks: Significantly reduced Prevention from cyber-attacks, fraud and system downtimes Ensures compliance to internal and external security and quality baselines Comprehensive approach to SAP Security through integration into IT security solutions (SIEM/SAP ETD) System configuration: fully secured Expert knowledge guarantees comprehensive coverage of all security relevant settings Over 300 predefined and configured tests will be delivered with the standard Reduced complexity and full scalability due to flexible security policies Central administration: up to 80 % less effort and costs Reduced operative effort through centralized architecture Continuous monitoring of the entire system landscape and comprehensive reporting Proactive approach and automated corrections

16 Virtual Forge SystemProfiler General Features Inspection Policies Individual security policy for each system Flexible and powerful black-/whitelist management Finding Manager Detailed information and description for all findings Options for automated and manual correction directly accessible Complete architecture Covers HANA, ABAP and Java-based SAP systems Includes built-in reporting options Open integration into adjacent solutions (SIEM, SAP ETD, Ticketing, ) Extensible and customizable Test Cases

17 SystemProfiler: for a Secure SAP Environment SAP Complete Scan in validation the cloud Policies SAP system landscape Automated security Validation Results Full transparency Monitoring & Reporting 100% integration

18 Code Validation: CodeProfiler

19 What CodeProfiler can do for You With one critical issue for every lines of code in an average SAP system, attackers have plenty of vulnerabilites to chose from. For you this means: CodeProfiler for ABAP and CodeProfiler for HANA act as a custom code firewall, preventing insecure and unstable code to enter production. Custom code contains a considerable number of performance and robustness deficiencies, increasing the likelihood of data corruption or system downtime. For you this means: CodeProfiler for ABAP and CodeProfiler for HANA integrate directly into the development process and identify possible issues early on.

20 Secure & improve Your Custom Code CODEPROFILER for ABAP & CODEPROFILER for HANA Code layer Security Compliance Quality Virtual Forge CodeProfilers pinpoint and correct security, compliance and performance vulnerabilities in ABAP and HANA programs before downtimes and long runtime cause expensive corrections or security vulnerability's are exploited by attackers.. 20

21 Virtual Forge CodeProfiler - for You this means... Knowledge is power: 75% less correction costs Development and maintenance costs will be reduced by improving the quality of programs The power in your SAP code: 84% faster and failsafe programs Reduce run-time and hardware utilization through improved performance Minimize system failures and downtime using selective corrections HANA optimization: prepare your ABAP TM code for HANA SAP Code Firewall: 92% less effort and costs reduced by 98% Set quality standards for internal and external developments Accurate and resource-saving analysis and evaluation 100% more security and compliance Prevents data theft and industrial espionage

22 Virtual Forge CodeProfilers General Features Full integration into development process Users don t need to learn a new tool Frictionless process integration Finding Manager Detailed information and description for all findings Innovative functionality Automated correction possibilities Includes built-in reporting options Extensible and customizable Test Cases More than 250 test cases for security, compliance and quality

23 CodeProfiler: the Standard for SAP Code Scan All ABAP objects, SAP Scan in the cloud many HANA objects Firewall / Scan on commit CodeProfiler TMS Integration CodeProfiler Scan SAP system landscape Development Transport Release Existing Code Extensive content Patented technology Monitoring & Reporting 100% integration

24 Reporting: Visualizing Results and Trends

25 Virtual Forge Reporting in a Nutshell Separate solution covering all Virtual Forge solutions: SystemProfiler CodeProfiler for ABAP TransportProfiler (planned) Pre-defined content Different KPIs specific to each solution Scope can be set for each customer individually Fully integrated into SAP Developed in ABAP Using ICF-Services and AngularJS

26 26 Virtual Forge Reporting

27 27 SystemProfiler Reporting

28 Virtual Forge Cloud

29 Virtual Forge Cloud: Fast & Smart SAP Scan SAP Secure Scan in SAP the Code cloud SAP Addon Check History, Benchmark Reporting

30 How Safe is Your SAP System? Free Risk Assessment Security SAP Compliance Quality Summary & Specific Examples of Findings Vulnerabilities Prioritization & Classification System, Code & Transport Metrics

31 Disclaimer 2017 Virtual Forge GmbH. All rights reserved. Information contained in this publication is subject to change without prior notice. These materials are provided by Virtual Forge and serve only as information. SAP, ABAP and other named SAP products and services as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries worldwide. All other names of products and services are trademarks of their respective companies. Virtual Forge accepts no liability or responsibility for errors or omissions in this publication. From the information contained in this publication, no further liability is assumed. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of Virtual Forge GmbH, Germany or Virtual Forge Inc. The General Terms and Conditions of Virtual Forge apply.

32 Thank you very much for your attention! Christer Mäkelä CEO, ADSOTECH

33