SAP CyberSecurity, SAP Technical Security Administration

Learn how vulnerability management identifies, evaluates, prioritizes, remediates, and reports security weaknesses in SAP systems and software, using SAP security notes and patching practices to reduce cyber risk.

Review and apply security SAP notes to patch vulnerabilities with minimal functional impact, assigning ownership to the security team and system owner, and using SAP Service Marketplace and Solution Manager.

Explore threat detection concepts in SAP, including how SIEMs collect SAP security logs, and compare direct log forwarding to SAP threat management plugins with SAP-specific detection rules.

Explore SAP enterprise threat detection, its on premise edition, real-time threat detection, log collection from SAP and third-party systems, alerting to SIEM, and configurable detection patterns.

Explore sap etd embedded in the sap basis component, sending logs to a web service with no plugin, and demonstrate patterns, alerts, and anonymization in Fiori.

Design a secure SAP architecture with network segmentation and traffic filtering to ensure high availability and disaster recovery, using Azure and AWS templates for on premise workloads.

Understand SAP password complexity rules, including minimum length and character requirements, and how policy parameters enforce compliance for users, including system and service users, with non-compliance prompts and midnight unlock.

Explore why password policies protect high-privilege system users and how to implement them with SAP security policy, including server logon privilege and maintenance window controls.

Learn how SAP uses one-way password hashes, salted with a random value, stores the hash with the user record, and authenticates by comparing input hash.

Explore how SAP generates and stores password hashes in the usr02 table, detailing the pcode/pwd salted hash columns and the progression from md5 legacy hashes to iterated random salted hashes.

Gain hands-on insight into SAP password hashes by toggling a dynamic parameter to switch between legacy and salted hashes, and observe how username and salt affect the results.

Explore weak password hashes in sap, including 8-character passwords hashed with md5 and stored in decode column, governed by login password to downloads compatibility parameter where zero disables weak hashes.

See how weak SAP hashes enable password recovery with Hashcat. Learn about legacy and salted hashes, input formats, and how password complexity affects security.

Identify and remove weak password hashes by using the cleanup password hash values report, verify hashes in US r02 tables, and perform necessary manual resets where needed.

In this hands-on SAP security session, learn to identify and remove weak password hashes using AC16, run a cleanup report, and verify results, noting legacy hashes require manual resets.

Understand the RFC gateway architecture in SAP, comparing ABAP and Java deployments, their gateways, program ID, and high availability considerations, with monitoring via the SMTW transaction.

Explore the RFC protocol, a remote function call framework for SAP system-to-system communication, with libraries like RFC SDK and Java Connector. Note its lack of encryption and password risks.

Explore hands-on rfc sdk usage by building an app in visual studio to connect to SAP system, fetch metadata, call a function module, and apply least-privilege security to system users.

Explore how type 3 RFC connections operate, focusing on gateway options, logon security, trust relationships, and enforcing strict access with authorization objects and SNC encryption.

Explore RFC connections that execute operating system commands within SAP, including stopping and starting systems across servers, with emphasis on destination authorization and gateway ACLs and sick info.

Explore RFC registered programs, a TCP/IP connection using a program ID registered on the SAP gateway to connect SAP systems with third party or SAP Java systems.

See how a misconfigured rec info ACL enables hijacking of registered RFC servers and learn to secure the system by defining precise internal roles for IGs and RFC servers.

Identify and set the callback ACLs for each RFC connection and enforce the RFC callback security method to three, denying all callbacks unless explicitly allowed.

Explore how an RFC callback from a compromised SAP system can create a backdoor user and modify function modules, and defend with RFC connection whitelists and strict security mode.

Enable and configure the SAP security audit log to record security events, choose an event locking strategy, enable integrity protection, and monitor for suspicious activities.

Explore the security audit log's integrity protection by auditing its settings, simulating a mischievous activity, and attempting to modify the OS-level log, then enable integrity protection.

Demonstrate how enabling integrity protection stabilizes the security audit log by running an integrity check, revealing modified entries, and showing how protected logs resist tampering.

Enable and verify table logging to track customizing changes in SAP, including who changed what and when, using data dictionary settings and transport profiles.

This hands-on session demonstrates table logging in SAP, showing how customizing changes are recorded, transported, and verified via the table change log using SPRO, ESCO three, and C16.

Configure the transport management system to enable table change logging, import and re-import transports, and verify table change logs in the SAP CAP system.

Enable and configure SAP ICM and SAP Gateway logs to capture inbound and outbound HTTP and RFC traffic, including TLS version, real source IP, and security events.

Explain how the SAP web dispatcher acts as a load balancer and reverse proxy for http/https, leveraging the ICM framework and enhancing security in SAP networks.

review the web dispatcher security logs—access, client, and security logs—with inbound request details such as timestamp, source IP, URL, and return code, mirroring ICM logging.

Securely monitor and configure the SAP web dispatcher with the web administration interface, manage certificates and parameters, and enforce access via ICM and HTTPS.

Access the web dispatcher and ICM public pages and the web administration interface, compare anonymous access status, and review exposed services, kernel version, and system details.

Disable public pages in the SAP ICM by setting admin_0 to false, updating the instance profile, restarting the system, and verifying public pages are no longer accessible.

The default web administration authentication uses the authorization file (password or certificate); other options include operating system or backend SAP/HANA; the file is text and defined by auth file parameter.

Explore how SAP GUI scripting automates tasks and the security risks of mass data access, and learn practical controls: enabling flags, viewer mode, and restricted usage.

Analyze unencrypted, sometimes compressed diag protocol transmissions that can be sniffed with a Wireshark plugin, exposing credentials and debunking myths about secure SAP GUI.

Explore remote enabled function modules and their security, including Yukon firewall, RFC checks, and the SASF framework, to safeguard SAP systems from misuse while enabling safe external calls.

Explore the unified connectivity through the Yukon firewall, focusing on the RFC scenario to control external access to SAP function modules.

Implement UCON in RFC scenario by configuring a dynamic SAP parameter, defining the logging and evaluation phase durations, and scheduling statistics collection with secure by default for new function modules.

Protect remote-enabled function modules by enforcing explicit authorization checks and strict s_rfc whitelisting, while using a system user under least privilege to minimize risk.

Activate and configure Yukon for UCON, setting RFC active to one, adjusting phase durations, and validating statistics via the Saarbrücken Management job to confirm Yukon is set up.

In the Yukon cockpit hands-on session, review seven function modules, move them from logging to evaluation to final, and ensure 23 function modules have CA assignments for external access.

Demonstrates how Yukon controls external RFC calls by testing function modules across internal and external clients, showing access when credentials exist and blocking when absent.

Demonstrates the security risks of an RFC user with SAP_ALL by altering ABAP user type from system to dialogue, enabling remote logon and access via SM59.