ABAP Code Security - SAP Code Vulnerability Analyzer / Virtual Forge CodeProfiler for ABAP
Technological basis for SAP Fiori (SAP Gateway)
Because hybrid landscapes are seen as the operating model of the future, it is necessary to develop monitoring strategies for this. What is important is an end-to-end view based on the process and not just an individual view of the systems, services or components involved. This supports the requirement of a company-wide interface function of the SAP basis.
PROJECT HISTORIES: THE SAP basis OF TOMORROW An entry in the Forum Infrastructure and Operations within the DSAGNet drew attention to the problem of the SAP basis as described above. This led to a lively discussion, which attracted a lot of interest from the members of the DSAM. Building on the interest and need for action of the member companies, a project was initiated by the DSAG as well as by the SAP, which should deal with the future of the SAP basis. Several companies were invited to participate and their willingness to participate actively was questioned in a DSAG survey. The first project meeting took place within the framework of the DSAG Annual Congress in Bremen in 2015. As a result, regular events took place at the SAP office in Freiberg am Neckar and St Leon-Rot, with the participation of up to 15 companies. In the project "the SAP basis of Tomorrow", current questions of the companies as well as the question of the SAP basis of the future were discussed and worked out with regard to the IT landscape, processes and organisational structure. A master's thesis was initiated to document and prepare the results as well as to examine the topic in scientific terms in parallel with the project. This was made at the University of Applied Sciences Würzburg-Schweinfurt as part of the Master's programme in Information Systems with Prof. Dr. Karl Liebschnitel and submitted for evaluation at the end of March 2016.
Double stack split
This saves us a lot of time and ensures that no checks are overlooked when performing manually. Security Automation via HR Permissions HR permissions are a very risky topic in many companies and are often only touched with silk gloves.
If your system is already above SAP NetWeaver Release 7.0, then you must either import SAP Note 1731549 or a corresponding Support Package. Afterwards, when creating new users, it is no longer possible to assign user names that are only composed of variants of spaces or other invisible special characters. Important: Changes to already existing users with these names or their deletion option are not affected by this! The SAP Note also adds the customizing switch BNAME_RESTRICT, whereupon you can control yourself whether alternative spaces are allowed to appear in certain places in the user name. For this, the following values must be set in the customizing table PRGN_CUST: NO = The alternative spaces are still allowed in the user name. ALL = The character set is reduced to a defined range, excluding certain special characters because they have specific meanings in certain operating systems or databases. This predefined character set is: ABCDEFGHIJKLNMOPQRSTUVWXYZ_0123456789,;-§&()={[]}+#. FME = The letters F, M and E stand for Front, Middle and End. With an 'X' in this three-digit switch value you can now explicitly specify at which position in the user name no wide spaces and control characters may occur. All combinations are possible, e.g.: XME = None of these special characters may occur at the BEGINNING of the user name. XMX = In the user name none of these special characters may occur at the BEGINNING and at the END. FME = One of these special characters may occur at any position in the user name (this corresponds to the default setting, i.e. as if no entry was maintained in PRGN_CUST for the switch). SAP recommends the use of the value ALL.
Some missing SAP basic functions in the standard are supplied by the PC application "Shortcut for SAP Systems".
The SAR files are unpacked with SAPCAR and checked for their digital signature.
To do this, select the Support Package that should be the last in the queue.